)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"baecb06cb5ae219bdf51d1a9a369c004858dfe39","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"SecurityImapct"},{"line_number":14,"context_line":"DocImpact"},{"line_number":15,"context_line":"bp/keystone-tokenless-authz-with-x509-ssl-client-cert"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Change-Id: Icc7305ca9d96f8e9cdc95ccde57de650801c6544"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"da86d52c_14b659dc","line":15,"updated":"2015-02-18 15:44:55.000000000","message":"this isn\u0027t getting picked up by launchpad, use: \n\n  implements bp keystone-tokenless-authz-with-x509-ssl-client-cert","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"963cafb3de73d44b73365724f8150468f808bc9a","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Implemented middleware to map an incoming trusted SSL client certificate"},{"line_number":10,"context_line":"into Keystone auth credential so we can perform authorization without"},{"line_number":11,"context_line":"having to issue a token."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"SecurityImapct"},{"line_number":14,"context_line":"DocImpact"},{"line_number":15,"context_line":"implements bp keystone-tokenless-authz-with-x509-ssl-client-cert"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":32,"id":"9a41bdd9_5f92394d","line":12,"updated":"2015-07-15 19:04:40.000000000","message":"guang needs to be added as co-author","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"635a96eca050e869fe5b34400a865f622f9bb5bd","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Implemented middleware to map an incoming trusted SSL client certificate"},{"line_number":10,"context_line":"into Keystone auth credential so we can perform authorization without"},{"line_number":11,"context_line":"having to issue a token."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"SecurityImapct"},{"line_number":14,"context_line":"DocImpact"},{"line_number":15,"context_line":"implements bp keystone-tokenless-authz-with-x509-ssl-client-cert"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":32,"id":"9a41bdd9_3f3df5dc","line":12,"in_reply_to":"9a41bdd9_5f92394d","updated":"2015-07-15 19:40:29.000000000","message":"ya got it boss","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"}],"doc/source/configure_tokenless_x509.rst":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"2aa069144e5a41481bd62d675e0efa48e0a737e4","unresolved":false,"context_lines":[{"line_number":22,"context_line":"-----------"},{"line_number":23,"context_line":"Definitions"},{"line_number":24,"context_line":"-----------"},{"line_number":25,"context_line":"* ``Tokenless Authorization``: provides an althernative support for service"},{"line_number":26,"context_line":" clients to be authorized from Keystone by using a X.509 SSL client"},{"line_number":27,"context_line":"certificate without having to issue a token."},{"line_number":28,"context_line":""}],"source_content_type":"text/x-rst","patch_set":21,"id":"baa041b7_dc6a5e1a","line":25,"updated":"2015-04-02 12:52:41.000000000","message":"While this is OPK for a first approximation, there is nothing in the implementation that is X509 specific, and this would work equally well for Kerberso, SAML, or OpenID Connect.","commit_id":"965ba1ea6cb25d1b6fd4620c2e17266c318a6fec"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"386ffe0cf56283202adfa9151e6d2ac07a6f7662","unresolved":false,"context_lines":[{"line_number":22,"context_line":"-----------"},{"line_number":23,"context_line":"Definitions"},{"line_number":24,"context_line":"-----------"},{"line_number":25,"context_line":"* ``Tokenless Authorization``: provides an althernative support for service"},{"line_number":26,"context_line":" clients to be authorized from Keystone by using a X.509 SSL client"},{"line_number":27,"context_line":"certificate without having to issue a token."},{"line_number":28,"context_line":""}],"source_content_type":"text/x-rst","patch_set":21,"id":"baa041b7_a3a06044","line":25,"in_reply_to":"baa041b7_dc6a5e1a","updated":"2015-04-03 22:46:20.000000000","message":"This implementation will be the experimental version and making the implementation to be generic enough to support all the possible mechanisms will make the scope of the implementation to be so big. \nRenaming it to be ``X509 Tokenless Authorization`` sounds fair to you?","commit_id":"965ba1ea6cb25d1b6fd4620c2e17266c318a6fec"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":".. WARNING::"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"    This feature is experimental and unsupported in Kilo."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"-----------"},{"line_number":23,"context_line":"Definitions"}],"source_content_type":"text/x-rst","patch_set":24,"id":"3acd31a7_ed21c24e","line":20,"updated":"2015-05-01 15:51:04.000000000","message":"In Kilo this feature isn\u0027t even experimental.\n\nAlso, why is it experimental an unsupported?","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Prerequisites"},{"line_number":31,"context_line":"-------------"},{"line_number":32,"context_line":"Keystone will be required running in Apache with https enabled. Certificate"},{"line_number":33,"context_line":"and key management are outside the scope of this document."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":24,"id":"3acd31a7_2dde9a3f","line":32,"updated":"2015-05-01 15:51:04.000000000","message":"change \"running\" to \"to be running\"\n\nThe document shouldn\u0027t say that Apache is required if this will work in any web container.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":36,"context_line":"Apache Configuration"},{"line_number":37,"context_line":"--------------------"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Make sure to enable SSL and have client authentication set to optional in"},{"line_number":40,"context_line":"the Apache virtual file. For Example:"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":".. code-block:: javascript"}],"source_content_type":"text/x-rst","patch_set":24,"id":"3acd31a7_adf2aad0","line":39,"updated":"2015-05-01 15:51:04.000000000","message":"the doc shouldn\u0027t say it must be optional if it can also be required.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":52,"context_line":"----------------------"},{"line_number":53,"context_line":"There are 3 configurable parameters can be defined in keystone.conf."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"    * ``trusted_issuer``"},{"line_number":56,"context_line":"        The list of trusted issuers is to further filter the certificates"},{"line_number":57,"context_line":"        that are allowed to participate in the X.509 tokenless authorization."},{"line_number":58,"context_line":"        If it is absent, no certificates will be allowed in the X.509"}],"source_content_type":"text/x-rst","patch_set":24,"id":"3acd31a7_8d1c8ec2","line":55,"updated":"2015-05-01 15:51:04.000000000","message":"I think it will be easier for some deployers if trusted_issuer didn\u0027t have to be set because they already set up a trusted CA in their httpd config file. So there should be an option to not have a trusted issuer configured in keystone.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":52,"context_line":"----------------------"},{"line_number":53,"context_line":"There are 3 configurable parameters can be defined in keystone.conf."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"    * ``trusted_issuer``"},{"line_number":56,"context_line":"        The list of trusted issuers is to further filter the certificates"},{"line_number":57,"context_line":"        that are allowed to participate in the X.509 tokenless authorization."},{"line_number":58,"context_line":"        If it is absent, no certificates will be allowed in the X.509"}],"source_content_type":"text/x-rst","patch_set":24,"id":"3acd31a7_943b72d1","line":55,"in_reply_to":"3acd31a7_8d1c8ec2","updated":"2015-05-01 21:28:34.000000000","message":"true. this is basically the second level of trust in the application level. can be done.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":56,"context_line":"        The list of trusted issuers is to further filter the certificates"},{"line_number":57,"context_line":"        that are allowed to participate in the X.509 tokenless authorization."},{"line_number":58,"context_line":"        If it is absent, no certificates will be allowed in the X.509"},{"line_number":59,"context_line":"        tokenless authorization. The value of an DN must be separated by a"},{"line_number":60,"context_line":"        comma and contains no spaces. This configuration option may be"},{"line_number":61,"context_line":"        repeated for multiple values. For example:"},{"line_number":62,"context_line":"        ``trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack``"}],"source_content_type":"text/x-rst","patch_set":24,"id":"3acd31a7_2d0d7a90","line":59,"updated":"2015-05-01 15:51:04.000000000","message":"change \"an DN\" to \"a DN\"\n\nDoes it have to be a DN?","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":56,"context_line":"        The list of trusted issuers is to further filter the certificates"},{"line_number":57,"context_line":"        that are allowed to participate in the X.509 tokenless authorization."},{"line_number":58,"context_line":"        If it is absent, no certificates will be allowed in the X.509"},{"line_number":59,"context_line":"        tokenless authorization. The value of an DN must be separated by a"},{"line_number":60,"context_line":"        comma and contains no spaces. This configuration option may be"},{"line_number":61,"context_line":"        repeated for multiple values. For example:"},{"line_number":62,"context_line":"        ``trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack``"}],"source_content_type":"text/x-rst","patch_set":24,"id":"3acd31a7_b471ceaa","line":59,"in_reply_to":"3acd31a7_2d0d7a90","updated":"2015-05-01 21:28:34.000000000","message":"yes, it has to be a whole DN that matches with the one in the trusted certificate.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":59,"context_line":"        tokenless authorization. The value of an DN must be separated by a"},{"line_number":60,"context_line":"        comma and contains no spaces. This configuration option may be"},{"line_number":61,"context_line":"        repeated for multiple values. For example:"},{"line_number":62,"context_line":"        ``trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack``"},{"line_number":63,"context_line":"        ``trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc``"},{"line_number":64,"context_line":"    * ``protocol``"},{"line_number":65,"context_line":"        The protocol name for the X.509 tokenless authorization along with"}],"source_content_type":"text/x-rst","patch_set":24,"id":"3acd31a7_4d8c3635","line":62,"updated":"2015-05-01 15:51:04.000000000","message":"the formatting here is going to be lost when the document is rendered. Fix up the rst.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":66,"context_line":"        the Idp name to look up its corresponding mapping. It defaults to"},{"line_number":67,"context_line":"        ``x509``."},{"line_number":68,"context_line":"    * ``issuer_attribute``"},{"line_number":69,"context_line":"        The issuer attribute that is served as a IdP for the X.509 tokenless"},{"line_number":70,"context_line":"        authorization along with the protocol to look up its corresponding"},{"line_number":71,"context_line":"        mapping. It defaults to ``SSL_CLIENT_I_DN``."},{"line_number":72,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"3acd31a7_2db1fae1","line":69,"updated":"2015-05-01 15:51:04.000000000","message":"change \"a IdP\" to \"an IdP\"","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":74,"context_line":"Setup Mapping"},{"line_number":75,"context_line":"-------------"},{"line_number":76,"context_line":"Like federation, X.509 tokenless authorization also utilizes mapping"},{"line_number":77,"context_line":"mechanism to formulate an indentity. The identity provider must be"},{"line_number":78,"context_line":"corresponding to the issuer of the X.509 SSL client certificate. Protocol"},{"line_number":79,"context_line":"for the given identity should be ``x509`` by default but can be configurable."},{"line_number":80,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"3acd31a7_6dded212","line":77,"updated":"2015-05-01 15:51:04.000000000","message":"change \"indentity\" to \"identity\"","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":74,"context_line":"Setup Mapping"},{"line_number":75,"context_line":"-------------"},{"line_number":76,"context_line":"Like federation, X.509 tokenless authorization also utilizes mapping"},{"line_number":77,"context_line":"mechanism to formulate an indentity. The identity provider must be"},{"line_number":78,"context_line":"corresponding to the issuer of the X.509 SSL client certificate. Protocol"},{"line_number":79,"context_line":"for the given identity should be ``x509`` by default but can be configurable."},{"line_number":80,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"3acd31a7_d4a56a04","line":77,"in_reply_to":"3acd31a7_6dded212","updated":"2015-05-01 21:28:34.000000000","message":"good catch, thx ;-)","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":82,"context_line":"-------------"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"The name of the IdP will need to be created from the client issuer DN and"},{"line_number":85,"context_line":"it should contains no spaces. And the following is the python code used to"},{"line_number":86,"context_line":"create the IdP name."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":24,"id":"3acd31a7_0d02be6f","line":85,"updated":"2015-05-01 15:51:04.000000000","message":"change \"contains\" to \"contain\"\n\nRemove \"And\"","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":85,"context_line":"it should contains no spaces. And the following is the python code used to"},{"line_number":86,"context_line":"create the IdP name."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":".. code-block:: ini"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"    hashed_idp \u003d hashlib.sha256(idp_name)"},{"line_number":91,"context_line":"    base64.b64encode(hashed_idp.digest())"}],"source_content_type":"text/x-rst","patch_set":24,"id":"3acd31a7_edf9c281","line":88,"updated":"2015-05-01 15:51:04.000000000","message":"this isn\u0027t an ini file, it\u0027s python.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":94,"context_line":"-----------------"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"The name of the protocol will be the one defined in keystone.conf as protocol"},{"line_number":97,"context_line":"which defaults to ``509``."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"Create a Map"},{"line_number":100,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":24,"id":"3acd31a7_6d2c9202","line":97,"updated":"2015-05-01 15:51:04.000000000","message":"it\u0027s x509 according to earlier docs.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":94,"context_line":"-----------------"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"The name of the protocol will be the one defined in keystone.conf as protocol"},{"line_number":97,"context_line":"which defaults to ``509``."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"Create a Map"},{"line_number":100,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":24,"id":"3acd31a7_34e37e35","line":97,"in_reply_to":"3acd31a7_6d2c9202","updated":"2015-05-01 21:28:34.000000000","message":"another good catch, thx","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":99,"context_line":"Create a Map"},{"line_number":100,"context_line":"------------"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"An user can be found based on the local mapping attributes, user_id or"},{"line_number":103,"context_line":"user_name, domain_id or domain_name. And the remote mapping attributes can"},{"line_number":104,"context_line":"be any of the client certificate attributes. For example:"},{"line_number":105,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"3acd31a7_0d399e41","line":102,"updated":"2015-05-01 15:51:04.000000000","message":"change \"An user\" to \"A user\"","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":131,"context_line":"    }"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"------------------------"},{"line_number":134,"context_line":"Setup Keystonemiddleware"},{"line_number":135,"context_line":"------------------------"},{"line_number":136,"context_line":"The following configurable options in Keystonemiddle should set to the"},{"line_number":137,"context_line":"correct values."}],"source_content_type":"text/x-rst","patch_set":24,"id":"3acd31a7_6d193288","line":134,"updated":"2015-05-01 15:51:04.000000000","message":"This should be auth_token middleware.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":133,"context_line":"------------------------"},{"line_number":134,"context_line":"Setup Keystonemiddleware"},{"line_number":135,"context_line":"------------------------"},{"line_number":136,"context_line":"The following configurable options in Keystonemiddle should set to the"},{"line_number":137,"context_line":"correct values."},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"    * ``auth_protocol``"}],"source_content_type":"text/x-rst","patch_set":24,"id":"3acd31a7_0d3f5ed7","line":136,"updated":"2015-05-01 15:51:04.000000000","message":"auth_token","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":144,"context_line":"        Sets to the full path of the private key file."},{"line_number":145,"context_line":"    *  ``cafile``"},{"line_number":146,"context_line":"        Sets to the full path of the trusted CA certificate file."},{"line_number":147,"context_line":"    * ``X-Project-Id``"},{"line_number":148,"context_line":"        If specified, its the project scope passed through the headers."},{"line_number":149,"context_line":"    * ``X-Project-Name``"},{"line_number":150,"context_line":"        If specified, its the project scope passed through the headers."}],"source_content_type":"text/x-rst","patch_set":24,"id":"3acd31a7_8d2b6e94","line":147,"updated":"2015-05-01 15:51:04.000000000","message":"These aren\u0027t config options.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":144,"context_line":"        Sets to the full path of the private key file."},{"line_number":145,"context_line":"    *  ``cafile``"},{"line_number":146,"context_line":"        Sets to the full path of the trusted CA certificate file."},{"line_number":147,"context_line":"    * ``X-Project-Id``"},{"line_number":148,"context_line":"        If specified, its the project scope passed through the headers."},{"line_number":149,"context_line":"    * ``X-Project-Name``"},{"line_number":150,"context_line":"        If specified, its the project scope passed through the headers."}],"source_content_type":"text/x-rst","patch_set":24,"id":"3acd31a7_b45b0ef6","line":147,"in_reply_to":"3acd31a7_8d2b6e94","updated":"2015-05-01 21:28:34.000000000","message":"yep, that\u0027s right. will be in a separated section.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"b92e11b2a4228db7b108410dceeb2aa01e286617","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Definitions"},{"line_number":20,"context_line":"-----------"},{"line_number":21,"context_line":"* ``X.509 Tokenless Authorization``"},{"line_number":22,"context_line":"    Provides an althernative support for service clients to be authorized"},{"line_number":23,"context_line":"    from Keystone by using a X.509 SSL client certificate without having"},{"line_number":24,"context_line":"    to issue a token."},{"line_number":25,"context_line":""}],"source_content_type":"text/x-rst","patch_set":26,"id":"1aca2d91_333036e8","line":22,"updated":"2015-05-07 16:38:39.000000000","message":"alternative.   \n\n\"Provides a means to authorize client operations with in Keystone by using...\"","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Prerequisites"},{"line_number":27,"context_line":"-------------"},{"line_number":28,"context_line":"Keystone is required to be running in a web container with https enabled,"},{"line_number":29,"context_line":"tests have been done with Apache. Certificate and key management are outside"},{"line_number":30,"context_line":"the scope of this document."},{"line_number":31,"context_line":""}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_6f7393b2","line":28,"updated":"2015-05-13 02:18:51.000000000","message":"change \"is required to be\" to \"must be\"\n\nchange , to ;","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Make sure to enable SSL and have client authentication set to optional in"},{"line_number":37,"context_line":"the Apache virtual file. Setting ``SSLVerifyClient`` to be ``optional`` to"},{"line_number":38,"context_line":"allow other token authentication methods. For Example:"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":".. code-block:: javascript"},{"line_number":41,"context_line":""}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_0f63f7dd","line":38,"updated":"2015-05-13 02:18:51.000000000","message":"lowercase \"example\"","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":48,"context_line":"----------------------"},{"line_number":49,"context_line":"Keystone Configuration"},{"line_number":50,"context_line":"----------------------"},{"line_number":51,"context_line":"There are 5 configurable options can be defined in keystone.conf."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"    * ``trusted_issuer``"},{"line_number":54,"context_line":"        The list of trusted issuers is to further filter the certificates"}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_cf9b9fc8","line":51,"updated":"2015-05-13 02:18:51.000000000","message":"remove 5 so we don\u0027t have to keep this in sync, just say \"The following options can be defined in keystone.conf:\"","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":51,"context_line":"There are 5 configurable options can be defined in keystone.conf."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"    * ``trusted_issuer``"},{"line_number":54,"context_line":"        The list of trusted issuers is to further filter the certificates"},{"line_number":55,"context_line":"        that are allowed to participate in the X.509 tokenless authorization."},{"line_number":56,"context_line":"        If it is absent, no certificates will be allowed in the X.509"},{"line_number":57,"context_line":"        tokenless authorization. The value of a DN must be separated by a"}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_6f46f324","line":54,"updated":"2015-05-13 02:18:51.000000000","message":"remove \"is\"","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":53,"context_line":"    * ``trusted_issuer``"},{"line_number":54,"context_line":"        The list of trusted issuers is to further filter the certificates"},{"line_number":55,"context_line":"        that are allowed to participate in the X.509 tokenless authorization."},{"line_number":56,"context_line":"        If it is absent, no certificates will be allowed in the X.509"},{"line_number":57,"context_line":"        tokenless authorization. The value of a DN must be separated by a"},{"line_number":58,"context_line":"        comma and contains no spaces. This configuration option may be"},{"line_number":59,"context_line":"        repeated for multiple values. For example::"}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_efe4233c","line":56,"updated":"2015-05-13 02:18:51.000000000","message":"if the option is absent and no_check_trusted_issuer is false then no certificates will be allowed.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":55,"context_line":"        that are allowed to participate in the X.509 tokenless authorization."},{"line_number":56,"context_line":"        If it is absent, no certificates will be allowed in the X.509"},{"line_number":57,"context_line":"        tokenless authorization. The value of a DN must be separated by a"},{"line_number":58,"context_line":"        comma and contains no spaces. This configuration option may be"},{"line_number":59,"context_line":"        repeated for multiple values. For example::"},{"line_number":60,"context_line":"        trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack"},{"line_number":61,"context_line":"        trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc"}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_6faa73d6","line":58,"updated":"2015-05-13 02:18:51.000000000","message":"change \"contains\" to \"contain\"\n\nWhat does it mean that the value of a DN must be separated by a comma?","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":59,"context_line":"        repeated for multiple values. For example::"},{"line_number":60,"context_line":"        trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack"},{"line_number":61,"context_line":"        trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc"},{"line_number":62,"context_line":"    * ``no_check_trusted_issuer``"},{"line_number":63,"context_line":"        Setting this option to ``True`` will disable the validation checking"},{"line_number":64,"context_line":"        on the trusted issuer from the client certificate. The trust"},{"line_number":65,"context_line":"        validation will all be replied on the web container configuration."}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_6f81534a","line":62,"updated":"2015-05-13 02:18:51.000000000","message":"suggest change this to \"check_trusted_issuer\"","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":60,"context_line":"        trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack"},{"line_number":61,"context_line":"        trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc"},{"line_number":62,"context_line":"    * ``no_check_trusted_issuer``"},{"line_number":63,"context_line":"        Setting this option to ``True`` will disable the validation checking"},{"line_number":64,"context_line":"        on the trusted issuer from the client certificate. The trust"},{"line_number":65,"context_line":"        validation will all be replied on the web container configuration."},{"line_number":66,"context_line":"        Therefore, this can be risky!"}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_2f491b32","line":63,"updated":"2015-05-13 02:18:51.000000000","message":"use \"true\" here rather than \"True\" since this is what the help text uses.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":62,"context_line":"    * ``no_check_trusted_issuer``"},{"line_number":63,"context_line":"        Setting this option to ``True`` will disable the validation checking"},{"line_number":64,"context_line":"        on the trusted issuer from the client certificate. The trust"},{"line_number":65,"context_line":"        validation will all be replied on the web container configuration."},{"line_number":66,"context_line":"        Therefore, this can be risky!"},{"line_number":67,"context_line":"    * ``protocol``"},{"line_number":68,"context_line":"        The protocol name for the X.509 tokenless authorization along with"}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_cfd03f56","line":65,"updated":"2015-05-13 02:18:51.000000000","message":"change \"will all be replied on\" to \"will rely on\".\n\nThe security of the system already relies on the web container configuration, so this doesn\u0027t seem risky to me.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":67,"context_line":"    * ``protocol``"},{"line_number":68,"context_line":"        The protocol name for the X.509 tokenless authorization along with"},{"line_number":69,"context_line":"        the Idp name to look up its corresponding mapping. It defaults to"},{"line_number":70,"context_line":"        ``x509``."},{"line_number":71,"context_line":"    * ``issuer_attribute``"},{"line_number":72,"context_line":"        The issuer attribute that is served as an IdP for the X.509 tokenless"},{"line_number":73,"context_line":"        authorization along with the protocol to look up its corresponding"}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_6f5dd3e8","line":70,"updated":"2015-05-13 02:18:51.000000000","message":"why does this need to be configurable?","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"7e506bafe89392ced44a8aafe46be1e6d47dfe68","unresolved":false,"context_lines":[{"line_number":67,"context_line":"    * ``protocol``"},{"line_number":68,"context_line":"        The protocol name for the X.509 tokenless authorization along with"},{"line_number":69,"context_line":"        the Idp name to look up its corresponding mapping. It defaults to"},{"line_number":70,"context_line":"        ``x509``."},{"line_number":71,"context_line":"    * ``issuer_attribute``"},{"line_number":72,"context_line":"        The issuer attribute that is served as an IdP for the X.509 tokenless"},{"line_number":73,"context_line":"        authorization along with the protocol to look up its corresponding"}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_20a229af","line":70,"in_reply_to":"9a0c5dc1_6f5dd3e8","updated":"2015-05-14 00:14:45.000000000","message":"that\u0027s right. It doesn\u0027t have to be configurable. But just in case someone wants a different name, and that was actually a suggestion from a previous commnet.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":71,"context_line":"    * ``issuer_attribute``"},{"line_number":72,"context_line":"        The issuer attribute that is served as an IdP for the X.509 tokenless"},{"line_number":73,"context_line":"        authorization along with the protocol to look up its corresponding"},{"line_number":74,"context_line":"        mapping. It defaults to ``SSL_CLIENT_I_DN``."},{"line_number":75,"context_line":"    * ``ephemeral_user``"},{"line_number":76,"context_line":"        When setting this option to True, the user referenced from the client"},{"line_number":77,"context_line":"        certificate CN does not need to be existed. A group needs to be"}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_0f6d3798","line":74,"updated":"2015-05-13 02:18:51.000000000","message":"would be useful to add an explanation of what SSL_CLIENT_I_DN is.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":73,"context_line":"        authorization along with the protocol to look up its corresponding"},{"line_number":74,"context_line":"        mapping. It defaults to ``SSL_CLIENT_I_DN``."},{"line_number":75,"context_line":"    * ``ephemeral_user``"},{"line_number":76,"context_line":"        When setting this option to True, the user referenced from the client"},{"line_number":77,"context_line":"        certificate CN does not need to be existed. A group needs to be"},{"line_number":78,"context_line":"        defined in the corresponding mapping and this ephemeral user will"},{"line_number":79,"context_line":"        have the same roles as what are assigned to the group. It defaults to"}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_8f0fe7e0","line":76,"updated":"2015-05-13 02:18:51.000000000","message":"change \"When setting this option to True\" to \"If this option is ``true``\"","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":74,"context_line":"        mapping. It defaults to ``SSL_CLIENT_I_DN``."},{"line_number":75,"context_line":"    * ``ephemeral_user``"},{"line_number":76,"context_line":"        When setting this option to True, the user referenced from the client"},{"line_number":77,"context_line":"        certificate CN does not need to be existed. A group needs to be"},{"line_number":78,"context_line":"        defined in the corresponding mapping and this ephemeral user will"},{"line_number":79,"context_line":"        have the same roles as what are assigned to the group. It defaults to"},{"line_number":80,"context_line":"        ``False``"}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_6f14b3f4","line":77,"updated":"2015-05-13 02:18:51.000000000","message":"change \"be existed\" to \"exist\"","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":77,"context_line":"        certificate CN does not need to be existed. A group needs to be"},{"line_number":78,"context_line":"        defined in the corresponding mapping and this ephemeral user will"},{"line_number":79,"context_line":"        have the same roles as what are assigned to the group. It defaults to"},{"line_number":80,"context_line":"        ``False``"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"-------------"},{"line_number":83,"context_line":"Setup Mapping"}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_0f0417be","line":80,"updated":"2015-05-13 02:18:51.000000000","message":"change ``False`` to ``false``, and add a . at the end of the sentence.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":82,"context_line":"-------------"},{"line_number":83,"context_line":"Setup Mapping"},{"line_number":84,"context_line":"-------------"},{"line_number":85,"context_line":"Like federation, X.509 tokenless authorization also utilizes mapping"},{"line_number":86,"context_line":"mechanism to formulate an identity. The identity provider must be"},{"line_number":87,"context_line":"corresponding to the issuer of the X.509 SSL client certificate. Protocol"},{"line_number":88,"context_line":"for the given identity should be ``x509`` by default but can be configurable."}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_cf2cbf4c","line":85,"updated":"2015-05-13 02:18:51.000000000","message":"change \"mapping\" to \"the mapping\"","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":84,"context_line":"-------------"},{"line_number":85,"context_line":"Like federation, X.509 tokenless authorization also utilizes mapping"},{"line_number":86,"context_line":"mechanism to formulate an identity. The identity provider must be"},{"line_number":87,"context_line":"corresponding to the issuer of the X.509 SSL client certificate. Protocol"},{"line_number":88,"context_line":"for the given identity should be ``x509`` by default but can be configurable."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"Create an Idp"}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_2f1ebb0c","line":87,"updated":"2015-05-13 02:18:51.000000000","message":"change \"must be corresponding\" to \"must correspond\"\n\nchange \"Protocol\" to \"The protocol\"","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":85,"context_line":"Like federation, X.509 tokenless authorization also utilizes mapping"},{"line_number":86,"context_line":"mechanism to formulate an identity. The identity provider must be"},{"line_number":87,"context_line":"corresponding to the issuer of the X.509 SSL client certificate. Protocol"},{"line_number":88,"context_line":"for the given identity should be ``x509`` by default but can be configurable."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"Create an Idp"},{"line_number":91,"context_line":"-------------"}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_cfd39f37","line":88,"updated":"2015-05-13 02:18:51.000000000","message":"change \"can be configurable\" to \"is configurable\"","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":91,"context_line":"-------------"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"The name of the IdP will need to be created from the client issuer DN and"},{"line_number":94,"context_line":"it should contains no spaces. And the following is the python code used to"},{"line_number":95,"context_line":"create the IdP name."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":".. code-block:: python"}],"source_content_type":"text/x-rst","patch_set":26,"id":"1aca2d91_45830dcd","line":94,"updated":"2015-05-13 02:18:51.000000000","message":"change \"contains\" to \"contain\"\n\nRemove \"And\"","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":108,"context_line":"Create a Map"},{"line_number":109,"context_line":"------------"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"An user can be found based on the local mapping attributes, user_id or"},{"line_number":112,"context_line":"user_name, domain_id or domain_name. And the remote mapping attributes can"},{"line_number":113,"context_line":"be any of the client certificate attributes. For example:"},{"line_number":114,"context_line":""}],"source_content_type":"text/x-rst","patch_set":26,"id":"1aca2d91_6565e943","line":111,"updated":"2015-05-13 02:18:51.000000000","message":"change \"An user\" to \"A user\"","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":171,"context_line":"    }"},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"---------------------------------------"},{"line_number":174,"context_line":"Setup ``auth_token`` Keystonemiddleware"},{"line_number":175,"context_line":"---------------------------------------"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"Configurable Options"}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_0ff2d7d2","line":174,"updated":"2015-05-13 02:18:51.000000000","message":"change \"Keystonemiddleware\" to \"middleware\"\n\nremove `` from auth_token","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":176,"context_line":""},{"line_number":177,"context_line":"Configurable Options"},{"line_number":178,"context_line":"---------------------"},{"line_number":179,"context_line":"The following configurable options in ``auth_token`` Keystonemiddleware"},{"line_number":180,"context_line":"should set to the correct values -"},{"line_number":181,"context_line":""},{"line_number":182,"context_line":"    * ``auth_protocol``"}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_efee63eb","line":179,"updated":"2015-05-13 02:18:51.000000000","message":"change \"Keystonemiddleware\" to \"middleware\"","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":190,"context_line":""},{"line_number":191,"context_line":"Scope Information"},{"line_number":192,"context_line":"-----------------"},{"line_number":193,"context_line":"The scope information will be passed from the headers with the following"},{"line_number":194,"context_line":"keywords -"},{"line_number":195,"context_line":""},{"line_number":196,"context_line":"    * ``X-Project-Id``"}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_efc5435b","line":193,"updated":"2015-05-13 02:18:51.000000000","message":"passed to what?","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":191,"context_line":"Scope Information"},{"line_number":192,"context_line":"-----------------"},{"line_number":193,"context_line":"The scope information will be passed from the headers with the following"},{"line_number":194,"context_line":"keywords -"},{"line_number":195,"context_line":""},{"line_number":196,"context_line":"    * ``X-Project-Id``"},{"line_number":197,"context_line":"        If specified, its the project scope."}],"source_content_type":"text/x-rst","patch_set":26,"id":"9a0c5dc1_cfba7fe1","line":194,"updated":"2015-05-13 02:18:51.000000000","message":"change - to :","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"a2cab849c5e8441c44c399393084b3484b548c58","unresolved":false,"context_lines":[{"line_number":32,"context_line":"Apache Configuration"},{"line_number":33,"context_line":"--------------------"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Make sure to enable SSL and have client authentication set to optional in"},{"line_number":36,"context_line":"the Apache virtual file. Setting ``SSLVerifyClient`` to be ``optional`` to"},{"line_number":37,"context_line":"allow other token authentication methods. For example:"},{"line_number":38,"context_line":""}],"source_content_type":"text/x-rst","patch_set":32,"id":"9a41bdd9_829b8a17","line":35,"updated":"2015-07-15 19:57:47.000000000","message":"(nit) These two sentences sound clunky. Maybe combine them like: Make sure to enable SSL and have client authentication (``SSLVerifyClient``) set as ``optional`` to allow....","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"8ada87ee5b062ac22c3cd494fd285e3982f06c4e","unresolved":false,"context_lines":[{"line_number":32,"context_line":"Apache Configuration"},{"line_number":33,"context_line":"--------------------"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Make sure to enable SSL and have client authentication set to optional in"},{"line_number":36,"context_line":"the Apache virtual file. Setting ``SSLVerifyClient`` to be ``optional`` to"},{"line_number":37,"context_line":"allow other token authentication methods. For example:"},{"line_number":38,"context_line":""}],"source_content_type":"text/x-rst","patch_set":32,"id":"9a41bdd9_68c0a550","line":35,"in_reply_to":"9a41bdd9_829b8a17","updated":"2015-07-16 02:50:56.000000000","message":"done","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":10311,"name":"Joseph Davis","email":"joseph.davis@suse.com","username":"joadavis"},"change_message_id":"16dab03d3ebf21137da82ea89d09555e2b062fa6","unresolved":false,"context_lines":[{"line_number":60,"context_line":"        trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc"},{"line_number":61,"context_line":"    * ``protocol``"},{"line_number":62,"context_line":"        The protocol name for the X.509 tokenless authorization along with"},{"line_number":63,"context_line":"        the Idp name to look up its corresponding mapping. It defaults to"},{"line_number":64,"context_line":"        ``x509``."},{"line_number":65,"context_line":"    * ``issuer_attribute``"},{"line_number":66,"context_line":"        The issuer attribute that is served as an IdP for the X.509 tokenless"}],"source_content_type":"text/x-rst","patch_set":32,"id":"ba3cc151_60a17295","line":63,"updated":"2015-07-09 23:52:41.000000000","message":"Lowercased \"Idp\" (see comment below)","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":10311,"name":"Joseph Davis","email":"joseph.davis@suse.com","username":"joadavis"},"change_message_id":"16dab03d3ebf21137da82ea89d09555e2b062fa6","unresolved":false,"context_lines":[{"line_number":83,"context_line":"to the issuer of the X.509 SSL client certificate. The protocol for the"},{"line_number":84,"context_line":"given identity should be ``x509`` by default but can be configurable."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Create an Idp"},{"line_number":87,"context_line":"-------------"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"The name of the IdP will need to be created from the client issuer DN and"}],"source_content_type":"text/x-rst","patch_set":32,"id":"ba3cc151_008bc61f","line":86,"updated":"2015-07-09 23:52:41.000000000","message":"This is really nitpicky of me, but I was a little thrown off by the IdP acronym and had to think about whether it was an \"Identity Provider\" or \"Intrusion Detection and Prevention\" facillity.  So to be nitpicky, you might fix all instances of \"Idp\" to \"IdP\" (see above line) and add a definition for IdP at the Definitions section at the top of the file.","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"635a96eca050e869fe5b34400a865f622f9bb5bd","unresolved":false,"context_lines":[{"line_number":83,"context_line":"to the issuer of the X.509 SSL client certificate. The protocol for the"},{"line_number":84,"context_line":"given identity should be ``x509`` by default but can be configurable."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Create an Idp"},{"line_number":87,"context_line":"-------------"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"The name of the IdP will need to be created from the client issuer DN and"}],"source_content_type":"text/x-rst","patch_set":32,"id":"9a41bdd9_9f2e81a3","line":86,"in_reply_to":"ba3cc151_008bc61f","updated":"2015-07-15 19:40:29.000000000","message":"Agreed. IdP that is.","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"a2cab849c5e8441c44c399393084b3484b548c58","unresolved":false,"context_lines":[{"line_number":93,"context_line":".. code-block:: python"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"    hashed_idp \u003d hashlib.sha256(idp_name)"},{"line_number":96,"context_line":"    base64.b64encode(hashed_idp.digest())"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Create a Protocol"},{"line_number":99,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":32,"id":"9a41bdd9_ed112753","line":96,"updated":"2015-07-15 19:57:47.000000000","message":"Why are we not just using the hex digest instead of base64 here?","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"8ada87ee5b062ac22c3cd494fd285e3982f06c4e","unresolved":false,"context_lines":[{"line_number":93,"context_line":".. code-block:: python"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"    hashed_idp \u003d hashlib.sha256(idp_name)"},{"line_number":96,"context_line":"    base64.b64encode(hashed_idp.digest())"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Create a Protocol"},{"line_number":99,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":32,"id":"9a41bdd9_28285d32","line":96,"in_reply_to":"9a41bdd9_ed112753","updated":"2015-07-16 02:50:56.000000000","message":"we want it to be URL friendly because that\u0027s essentially the IdP ID","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"a2cab849c5e8441c44c399393084b3484b548c58","unresolved":false,"context_lines":[{"line_number":104,"context_line":"Create a Map"},{"line_number":105,"context_line":"------------"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"A user can be found based on the local mapping attributes, user_id or"},{"line_number":108,"context_line":"user_name, domain_id or domain_name. And the remote mapping attributes can"},{"line_number":109,"context_line":"be any of the client certificate attributes. For example:"},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":32,"id":"9a41bdd9_cd3d43c5","line":107,"updated":"2015-07-15 19:57:47.000000000","message":"I can\u0027t parse this first sentence.","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"a2cab849c5e8441c44c399393084b3484b548c58","unresolved":false,"context_lines":[{"line_number":105,"context_line":"------------"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"A user can be found based on the local mapping attributes, user_id or"},{"line_number":108,"context_line":"user_name, domain_id or domain_name. And the remote mapping attributes can"},{"line_number":109,"context_line":"be any of the client certificate attributes. For example:"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":".. code-block:: javascript"}],"source_content_type":"text/x-rst","patch_set":32,"id":"9a41bdd9_4d50530b","line":108,"updated":"2015-07-15 19:57:47.000000000","message":"s/And t/T/","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"8ada87ee5b062ac22c3cd494fd285e3982f06c4e","unresolved":false,"context_lines":[{"line_number":105,"context_line":"------------"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"A user can be found based on the local mapping attributes, user_id or"},{"line_number":108,"context_line":"user_name, domain_id or domain_name. And the remote mapping attributes can"},{"line_number":109,"context_line":"be any of the client certificate attributes. For example:"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":".. code-block:: javascript"}],"source_content_type":"text/x-rst","patch_set":32,"id":"9a41bdd9_339bee67","line":108,"in_reply_to":"9a41bdd9_4d50530b","updated":"2015-07-16 02:50:56.000000000","message":"Done","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"a2cab849c5e8441c44c399393084b3484b548c58","unresolved":false,"context_lines":[{"line_number":173,"context_line":"Configurable Options"},{"line_number":174,"context_line":"---------------------"},{"line_number":175,"context_line":"The following configurable options in ``auth_token`` middleware"},{"line_number":176,"context_line":"should set to the correct values -"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"    * ``auth_protocol``"},{"line_number":179,"context_line":"        Sets to ``https``."}],"source_content_type":"text/x-rst","patch_set":32,"id":"9a41bdd9_0d7b2b7c","line":176,"updated":"2015-07-15 19:57:47.000000000","message":"Should this end in a -?","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"8ada87ee5b062ac22c3cd494fd285e3982f06c4e","unresolved":false,"context_lines":[{"line_number":173,"context_line":"Configurable Options"},{"line_number":174,"context_line":"---------------------"},{"line_number":175,"context_line":"The following configurable options in ``auth_token`` middleware"},{"line_number":176,"context_line":"should set to the correct values -"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"    * ``auth_protocol``"},{"line_number":179,"context_line":"        Sets to ``https``."}],"source_content_type":"text/x-rst","patch_set":32,"id":"9a41bdd9_b3d5bee5","line":176,"in_reply_to":"9a41bdd9_0d7b2b7c","updated":"2015-07-16 02:50:56.000000000","message":"done","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"fc39f07770cee69e1f84c4bf87925eee363668c4","unresolved":false,"context_lines":[{"line_number":55,"context_line":"        naming format for the attributes of a Distinguished Name(DN) must"},{"line_number":56,"context_line":"        be separated by a comma and contain no spaces. This configuration"},{"line_number":57,"context_line":"        option may be repeated for multiple values. For example::"},{"line_number":58,"context_line":"        trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack"},{"line_number":59,"context_line":"        trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc"},{"line_number":60,"context_line":"    * ``protocol``"},{"line_number":61,"context_line":"        The protocol name for the X.509 tokenless authorization along with"}],"source_content_type":"text/x-rst","patch_set":35,"id":"9a41bdd9_c85bc3f5","line":58,"updated":"2015-07-16 14:49:13.000000000","message":"trusted_issuer","commit_id":"0eb105e2f81d7e9a6a55e50d78d591c944b89b63"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"fc39f07770cee69e1f84c4bf87925eee363668c4","unresolved":false,"context_lines":[{"line_number":56,"context_line":"        be separated by a comma and contain no spaces. This configuration"},{"line_number":57,"context_line":"        option may be repeated for multiple values. For example::"},{"line_number":58,"context_line":"        trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack"},{"line_number":59,"context_line":"        trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc"},{"line_number":60,"context_line":"    * ``protocol``"},{"line_number":61,"context_line":"        The protocol name for the X.509 tokenless authorization along with"},{"line_number":62,"context_line":"        the IdP name to look up its corresponding mapping. It defaults to"}],"source_content_type":"text/x-rst","patch_set":35,"id":"9a41bdd9_286b4f87","line":59,"updated":"2015-07-16 14:49:13.000000000","message":"trusted_issuer","commit_id":"0eb105e2f81d7e9a6a55e50d78d591c944b89b63"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"fc39f07770cee69e1f84c4bf87925eee363668c4","unresolved":false,"context_lines":[{"line_number":133,"context_line":"        }"},{"line_number":134,"context_line":"    }"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"However, if ``ephemeral_user`` is used, the mapping must yeild at least one"},{"line_number":137,"context_line":"valid local group. For exampe:"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":".. code-block:: javascript"}],"source_content_type":"text/x-rst","patch_set":35,"id":"9a41bdd9_088c4b34","line":136,"updated":"2015-07-16 14:49:13.000000000","message":"yield","commit_id":"0eb105e2f81d7e9a6a55e50d78d591c944b89b63"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"fc39f07770cee69e1f84c4bf87925eee363668c4","unresolved":false,"context_lines":[{"line_number":166,"context_line":""},{"line_number":167,"context_line":"---------------------------------------"},{"line_number":168,"context_line":"Setup auth_token middleware"},{"line_number":169,"context_line":"---------------------------------------"},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"Configurable Options"},{"line_number":172,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":35,"id":"9a41bdd9_c8850308","line":169,"updated":"2015-07-16 14:49:13.000000000","message":"extra --","commit_id":"0eb105e2f81d7e9a6a55e50d78d591c944b89b63"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"fc39f07770cee69e1f84c4bf87925eee363668c4","unresolved":false,"context_lines":[{"line_number":176,"context_line":"    * ``auth_protocol``"},{"line_number":177,"context_line":"        Sets to ``https``."},{"line_number":178,"context_line":"    * ``certfile``"},{"line_number":179,"context_line":"        Sets to the full path of the certifie file."},{"line_number":180,"context_line":"    * ``keyfile``"},{"line_number":181,"context_line":"        Sets to the full path of the private key file."},{"line_number":182,"context_line":"    *  ``cafile``"}],"source_content_type":"text/x-rst","patch_set":35,"id":"9a41bdd9_4872534b","line":179,"updated":"2015-07-16 14:49:13.000000000","message":"certfile","commit_id":"0eb105e2f81d7e9a6a55e50d78d591c944b89b63"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"61544dd1dcfe12d262b2ee2d717d58a2a4acbe5a","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Definitions"},{"line_number":20,"context_line":"-----------"},{"line_number":21,"context_line":"* ``X.509 Tokenless Authorization``"},{"line_number":22,"context_line":"    Provides a means to authorize client operations with in Keystone by"},{"line_number":23,"context_line":"    using a X.509 SSL client certificate without having to issue a token."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Prerequisites"}],"source_content_type":"text/x-rst","patch_set":38,"id":"9a41bdd9_91b5da32","line":22,"updated":"2015-07-16 19:31:47.000000000","message":"(nit) within","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"bdcce290eed05722deaca8c9775b49517d0f8917","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Definitions"},{"line_number":20,"context_line":"-----------"},{"line_number":21,"context_line":"* ``X.509 Tokenless Authorization``"},{"line_number":22,"context_line":"    Provides a means to authorize client operations with in Keystone by"},{"line_number":23,"context_line":"    using a X.509 SSL client certificate without having to issue a token."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Prerequisites"}],"source_content_type":"text/x-rst","patch_set":38,"id":"9a41bdd9_37495e8f","line":22,"in_reply_to":"9a41bdd9_91b5da32","updated":"2015-07-16 20:18:50.000000000","message":"done","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"61544dd1dcfe12d262b2ee2d717d58a2a4acbe5a","unresolved":false,"context_lines":[{"line_number":20,"context_line":"-----------"},{"line_number":21,"context_line":"* ``X.509 Tokenless Authorization``"},{"line_number":22,"context_line":"    Provides a means to authorize client operations with in Keystone by"},{"line_number":23,"context_line":"    using a X.509 SSL client certificate without having to issue a token."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Prerequisites"},{"line_number":26,"context_line":"-------------"}],"source_content_type":"text/x-rst","patch_set":38,"id":"9a41bdd9_f17a2677","line":23,"updated":"2015-07-16 19:31:47.000000000","message":"s/a/an/","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"bdcce290eed05722deaca8c9775b49517d0f8917","unresolved":false,"context_lines":[{"line_number":20,"context_line":"-----------"},{"line_number":21,"context_line":"* ``X.509 Tokenless Authorization``"},{"line_number":22,"context_line":"    Provides a means to authorize client operations with in Keystone by"},{"line_number":23,"context_line":"    using a X.509 SSL client certificate without having to issue a token."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Prerequisites"},{"line_number":26,"context_line":"-------------"}],"source_content_type":"text/x-rst","patch_set":38,"id":"9a41bdd9_9754ea21","line":23,"in_reply_to":"9a41bdd9_f17a2677","updated":"2015-07-16 20:18:50.000000000","message":"done","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"61544dd1dcfe12d262b2ee2d717d58a2a4acbe5a","unresolved":false,"context_lines":[{"line_number":35,"context_line":"Make sure to enable SSL and have client authentication (``SSLVerifyClient``)"},{"line_number":36,"context_line":"set as ``optional`` to allow other token authentication methods. For example:"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":".. code-block:: javascript"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"    SSLEngine on"},{"line_number":41,"context_line":"    SSLCertificateFile    /etc/apache2/ssl/apache.crt"}],"source_content_type":"text/x-rst","patch_set":38,"id":"9a41bdd9_d1d92285","line":38,"updated":"2015-07-16 19:31:47.000000000","message":"javascript? it\u0027s awesome that this looks OK when rendered.","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"bdcce290eed05722deaca8c9775b49517d0f8917","unresolved":false,"context_lines":[{"line_number":35,"context_line":"Make sure to enable SSL and have client authentication (``SSLVerifyClient``)"},{"line_number":36,"context_line":"set as ``optional`` to allow other token authentication methods. For example:"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":".. code-block:: javascript"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"    SSLEngine on"},{"line_number":41,"context_line":"    SSLCertificateFile    /etc/apache2/ssl/apache.crt"}],"source_content_type":"text/x-rst","patch_set":38,"id":"9a41bdd9_17169a55","line":38,"in_reply_to":"9a41bdd9_d1d92285","updated":"2015-07-16 20:18:50.000000000","message":"all our docs use this style I think","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"61544dd1dcfe12d262b2ee2d717d58a2a4acbe5a","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    SSLEngine on"},{"line_number":41,"context_line":"    SSLCertificateFile    /etc/apache2/ssl/apache.crt"},{"line_number":42,"context_line":"    SSLCertificateKeyFile /etc/apache2/ssl/apache.key"},{"line_number":43,"context_line":"    SSLCACertificatePath /capath"},{"line_number":44,"context_line":"    SSLVerifyClient optional"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"----------------------"}],"source_content_type":"text/x-rst","patch_set":38,"id":"9a41bdd9_11ceaab4","line":43,"updated":"2015-07-16 19:31:47.000000000","message":"Is this a fully qualified path?","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"bdcce290eed05722deaca8c9775b49517d0f8917","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    SSLEngine on"},{"line_number":41,"context_line":"    SSLCertificateFile    /etc/apache2/ssl/apache.crt"},{"line_number":42,"context_line":"    SSLCertificateKeyFile /etc/apache2/ssl/apache.key"},{"line_number":43,"context_line":"    SSLCACertificatePath /capath"},{"line_number":44,"context_line":"    SSLVerifyClient optional"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"----------------------"}],"source_content_type":"text/x-rst","patch_set":38,"id":"9a41bdd9_9702aa0a","line":43,"in_reply_to":"9a41bdd9_11ceaab4","updated":"2015-07-16 20:18:50.000000000","message":"yes. Let me make it clearer.","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"61544dd1dcfe12d262b2ee2d717d58a2a4acbe5a","unresolved":false,"context_lines":[{"line_number":80,"context_line":"Like federation, X.509 tokenless authorization also utilizes the mapping"},{"line_number":81,"context_line":"mechanism to formulate an identity. The identity provider must correspond"},{"line_number":82,"context_line":"to the issuer of the X.509 SSL client certificate. The protocol for the"},{"line_number":83,"context_line":"given identity should be ``x509`` by default but can be configurable."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"Create an IdP"},{"line_number":86,"context_line":"-------------"}],"source_content_type":"text/x-rst","patch_set":38,"id":"9a41bdd9_51be72d5","line":83,"updated":"2015-07-16 19:31:47.000000000","message":", but","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"bdcce290eed05722deaca8c9775b49517d0f8917","unresolved":false,"context_lines":[{"line_number":80,"context_line":"Like federation, X.509 tokenless authorization also utilizes the mapping"},{"line_number":81,"context_line":"mechanism to formulate an identity. The identity provider must correspond"},{"line_number":82,"context_line":"to the issuer of the X.509 SSL client certificate. The protocol for the"},{"line_number":83,"context_line":"given identity should be ``x509`` by default but can be configurable."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"Create an IdP"},{"line_number":86,"context_line":"-------------"}],"source_content_type":"text/x-rst","patch_set":38,"id":"9a41bdd9_7a1cab6a","line":83,"in_reply_to":"9a41bdd9_51be72d5","updated":"2015-07-16 20:18:50.000000000","message":"done","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"61544dd1dcfe12d262b2ee2d717d58a2a4acbe5a","unresolved":false,"context_lines":[{"line_number":86,"context_line":"-------------"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"The name of the IdP will need to be created from the client issuer DN and"},{"line_number":89,"context_line":"it should contain no spaces. The following is the python code used to"},{"line_number":90,"context_line":"create the IdP name."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":".. code-block:: python"}],"source_content_type":"text/x-rst","patch_set":38,"id":"9a41bdd9_b1cd7e88","line":89,"updated":"2015-07-16 19:31:47.000000000","message":"Python","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"bdcce290eed05722deaca8c9775b49517d0f8917","unresolved":false,"context_lines":[{"line_number":86,"context_line":"-------------"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"The name of the IdP will need to be created from the client issuer DN and"},{"line_number":89,"context_line":"it should contain no spaces. The following is the python code used to"},{"line_number":90,"context_line":"create the IdP name."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":".. code-block:: python"}],"source_content_type":"text/x-rst","patch_set":38,"id":"9a41bdd9_7a334bf7","line":89,"in_reply_to":"9a41bdd9_b1cd7e88","updated":"2015-07-16 20:18:50.000000000","message":"done","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"61544dd1dcfe12d262b2ee2d717d58a2a4acbe5a","unresolved":false,"context_lines":[{"line_number":133,"context_line":"        }"},{"line_number":134,"context_line":"    }"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"However, if ``ephemeral_user`` is used, the mapping must yeild at least one"},{"line_number":137,"context_line":"valid local group. For exampe:"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":".. code-block:: javascript"}],"source_content_type":"text/x-rst","patch_set":38,"id":"9a41bdd9_91a95a7e","line":136,"updated":"2015-07-16 19:31:47.000000000","message":"yield","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"bdcce290eed05722deaca8c9775b49517d0f8917","unresolved":false,"context_lines":[{"line_number":133,"context_line":"        }"},{"line_number":134,"context_line":"    }"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"However, if ``ephemeral_user`` is used, the mapping must yeild at least one"},{"line_number":137,"context_line":"valid local group. For exampe:"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":".. code-block:: javascript"}],"source_content_type":"text/x-rst","patch_set":38,"id":"9a41bdd9_baaeb3e5","line":136,"in_reply_to":"9a41bdd9_91a95a7e","updated":"2015-07-16 20:18:50.000000000","message":"done","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"61544dd1dcfe12d262b2ee2d717d58a2a4acbe5a","unresolved":false,"context_lines":[{"line_number":134,"context_line":"    }"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"However, if ``ephemeral_user`` is used, the mapping must yeild at least one"},{"line_number":137,"context_line":"valid local group. For exampe:"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":".. code-block:: javascript"},{"line_number":140,"context_line":""}],"source_content_type":"text/x-rst","patch_set":38,"id":"9a41bdd9_51baf2c1","line":137,"updated":"2015-07-16 19:31:47.000000000","message":"example","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"bdcce290eed05722deaca8c9775b49517d0f8917","unresolved":false,"context_lines":[{"line_number":134,"context_line":"    }"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"However, if ``ephemeral_user`` is used, the mapping must yeild at least one"},{"line_number":137,"context_line":"valid local group. For exampe:"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":".. code-block:: javascript"},{"line_number":140,"context_line":""}],"source_content_type":"text/x-rst","patch_set":38,"id":"9a41bdd9_7ab82b2b","line":137,"in_reply_to":"9a41bdd9_51baf2c1","updated":"2015-07-16 20:18:50.000000000","message":"done","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"e64ac0161dad0f25fd7011c9e24a4fa1a3242680","unresolved":false,"context_lines":[{"line_number":25,"context_line":"Prerequisites"},{"line_number":26,"context_line":"-------------"},{"line_number":27,"context_line":"Keystone must be running in a web container with https enabled; tests have"},{"line_number":28,"context_line":"been done with Apache. Certificate and key management are outside the scope"},{"line_number":29,"context_line":"of this document."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":40,"id":"9a41bdd9_ec9ea462","line":28,"updated":"2015-07-17 13:45:41.000000000","message":"it would be cool to have a link to a doc about certificate and key management. Or a brief explanation for testing.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"c96b984cb110bd0df4fb322c0657686604287e88","unresolved":false,"context_lines":[{"line_number":25,"context_line":"Prerequisites"},{"line_number":26,"context_line":"-------------"},{"line_number":27,"context_line":"Keystone must be running in a web container with https enabled; tests have"},{"line_number":28,"context_line":"been done with Apache. Certificate and key management are outside the scope"},{"line_number":29,"context_line":"of this document."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":40,"id":"3a50d1a3_4c69d9bd","line":28,"in_reply_to":"9a41bdd9_ec9ea462","updated":"2015-07-20 18:56:00.000000000","message":"will try to include a link.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"e64ac0161dad0f25fd7011c9e24a4fa1a3242680","unresolved":false,"context_lines":[{"line_number":179,"context_line":"        Sets to the full path of the certificate file."},{"line_number":180,"context_line":"    * ``keyfile``"},{"line_number":181,"context_line":"        Sets to the full path of the private key file."},{"line_number":182,"context_line":"    *  ``cafile``"},{"line_number":183,"context_line":"        Sets to the full path of the trusted CA certificate file."},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"Scope Information"}],"source_content_type":"text/x-rst","patch_set":40,"id":"9a41bdd9_cce160d2","line":182,"updated":"2015-07-17 13:45:41.000000000","message":"(nit) 2 spaces here, not sure that they affect anything","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"c96b984cb110bd0df4fb322c0657686604287e88","unresolved":false,"context_lines":[{"line_number":179,"context_line":"        Sets to the full path of the certificate file."},{"line_number":180,"context_line":"    * ``keyfile``"},{"line_number":181,"context_line":"        Sets to the full path of the private key file."},{"line_number":182,"context_line":"    *  ``cafile``"},{"line_number":183,"context_line":"        Sets to the full path of the trusted CA certificate file."},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"Scope Information"}],"source_content_type":"text/x-rst","patch_set":40,"id":"3a50d1a3_ec87855f","line":182,"in_reply_to":"9a41bdd9_cce160d2","updated":"2015-07-20 18:56:00.000000000","message":"looks like they are not affecting anything but will remove them.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"21daff3783e31d5662225b45c8c63ac27589e31e","unresolved":false,"context_lines":[{"line_number":43,"context_line":"    SSLEngine on"},{"line_number":44,"context_line":"    SSLCertificateFile    /etc/apache2/ssl/apache.crt"},{"line_number":45,"context_line":"    SSLCertificateKeyFile /etc/apache2/ssl/apache.key"},{"line_number":46,"context_line":"    SSLCACertificatePath /etc/apache2/ssl/cacert.crt"},{"line_number":47,"context_line":"    SSLVerifyClient optional"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"----------------------"}],"source_content_type":"text/x-rst","patch_set":43,"id":"3a50d1a3_28d1d2fb","line":46,"updated":"2015-07-24 21:23:29.000000000","message":"should be SSLCACertificateFile or SSLCACertificatePath","commit_id":"d05acbf5007f932b41cd36e28575f238e046f332"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"8821e4475aecd947fda8b09b33d1a80c6f865357","unresolved":false,"context_lines":[{"line_number":43,"context_line":"    SSLEngine on"},{"line_number":44,"context_line":"    SSLCertificateFile    /etc/apache2/ssl/apache.crt"},{"line_number":45,"context_line":"    SSLCertificateKeyFile /etc/apache2/ssl/apache.key"},{"line_number":46,"context_line":"    SSLCACertificatePath /etc/apache2/ssl/cacert.crt"},{"line_number":47,"context_line":"    SSLVerifyClient optional"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"----------------------"}],"source_content_type":"text/x-rst","patch_set":43,"id":"3a50d1a3_1e13ec5d","line":46,"in_reply_to":"3a50d1a3_28d1d2fb","updated":"2015-07-24 22:21:47.000000000","message":"good catch! I intended to use SSLCACertificatePath","commit_id":"d05acbf5007f932b41cd36e28575f238e046f332"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"0ef192acbb4404d408d07f4cac6dcff297e186b1","unresolved":false,"context_lines":[{"line_number":101,"context_line":"-----------------"},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"The name of the protocol will be the one defined in keystone.conf as protocol"},{"line_number":104,"context_line":"which defaults to ``x509``."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"Create a Map"},{"line_number":107,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":43,"id":"3a50d1a3_54f2b49b","line":104,"updated":"2015-07-24 23:20:49.000000000","message":"this should probably go after the mapping","commit_id":"d05acbf5007f932b41cd36e28575f238e046f332"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"7d82284ff2513d9f549a1147312aba741cf5ebac","unresolved":false,"context_lines":[{"line_number":101,"context_line":"-----------------"},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"The name of the protocol will be the one defined in keystone.conf as protocol"},{"line_number":104,"context_line":"which defaults to ``x509``."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"Create a Map"},{"line_number":107,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":43,"id":"3a50d1a3_37bdaad7","line":104,"in_reply_to":"3a50d1a3_54f2b49b","updated":"2015-07-25 00:14:39.000000000","message":"you got it.","commit_id":"d05acbf5007f932b41cd36e28575f238e046f332"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"21daff3783e31d5662225b45c8c63ac27589e31e","unresolved":false,"context_lines":[{"line_number":169,"context_line":""},{"line_number":170,"context_line":"---------------------------------------"},{"line_number":171,"context_line":"Setup auth_token middleware"},{"line_number":172,"context_line":"---------------------------------------"},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"Configurable Options"},{"line_number":175,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":43,"id":"3a50d1a3_7ad06ec9","line":172,"updated":"2015-07-24 21:23:29.000000000","message":"remove extra \"-\"","commit_id":"d05acbf5007f932b41cd36e28575f238e046f332"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"8821e4475aecd947fda8b09b33d1a80c6f865357","unresolved":false,"context_lines":[{"line_number":169,"context_line":""},{"line_number":170,"context_line":"---------------------------------------"},{"line_number":171,"context_line":"Setup auth_token middleware"},{"line_number":172,"context_line":"---------------------------------------"},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"Configurable Options"},{"line_number":175,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":43,"id":"3a50d1a3_9e25bcaf","line":172,"in_reply_to":"3a50d1a3_7ad06ec9","updated":"2015-07-24 22:21:47.000000000","message":"yep","commit_id":"d05acbf5007f932b41cd36e28575f238e046f332"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"99a8e51e8bba3291f7b20118fe500016df0ab8ac","unresolved":false,"context_lines":[{"line_number":18,"context_line":"-----------"},{"line_number":19,"context_line":"Definitions"},{"line_number":20,"context_line":"-----------"},{"line_number":21,"context_line":"* ``X.509 Tokenless Authorization``"},{"line_number":22,"context_line":"    Provides a means to authorize client operations within Keystone by"},{"line_number":23,"context_line":"    using an X.509 SSL client certificate without having to issue a token."},{"line_number":24,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"3a50d1a3_9177ff9e","line":21,"updated":"2015-07-30 19:16:53.000000000","message":"this should be formatted something like:\n\n* `X.509 Tokenless Authorization`: Provides a means to authorize client operations within Keystone by\t using\n   an X.509 SSL client certificate without having to issue a token.\n\nchanges:\n1.  use singe ` instead of two\n2. added colon and put the description on the same line\n\nsee sample: https://raw.githubusercontent.com/openstack/keystone/6a6fcc22bef6f81dd202928e9c3f342c3338ad73/doc/source/configure_federation.rst","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"288bb4dade83c0212c1f9f86638d0843b09cae40","unresolved":false,"context_lines":[{"line_number":18,"context_line":"-----------"},{"line_number":19,"context_line":"Definitions"},{"line_number":20,"context_line":"-----------"},{"line_number":21,"context_line":"* ``X.509 Tokenless Authorization``"},{"line_number":22,"context_line":"    Provides a means to authorize client operations within Keystone by"},{"line_number":23,"context_line":"    using an X.509 SSL client certificate without having to issue a token."},{"line_number":24,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"3a50d1a3_b948da8b","line":21,"in_reply_to":"3a50d1a3_9177ff9e","updated":"2015-07-31 21:31:31.000000000","message":"you got it!","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"99a8e51e8bba3291f7b20118fe500016df0ab8ac","unresolved":false,"context_lines":[{"line_number":40,"context_line":"``SSLOptions`` needs to set as ``+StdEnvVars`` to allow certificate attributes"},{"line_number":41,"context_line":"to be passed. For example:"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":".. code-block:: javascript"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"    SSLEngine on"},{"line_number":46,"context_line":"    SSLCertificateFile    /etc/apache2/ssl/apache.crt"}],"source_content_type":"text/x-rst","patch_set":47,"id":"3a50d1a3_310dcbe8","line":43,"updated":"2015-07-30 19:16:53.000000000","message":".. code-block:: ini","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"288bb4dade83c0212c1f9f86638d0843b09cae40","unresolved":false,"context_lines":[{"line_number":40,"context_line":"``SSLOptions`` needs to set as ``+StdEnvVars`` to allow certificate attributes"},{"line_number":41,"context_line":"to be passed. For example:"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":".. code-block:: javascript"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"    SSLEngine on"},{"line_number":46,"context_line":"    SSLCertificateFile    /etc/apache2/ssl/apache.crt"}],"source_content_type":"text/x-rst","patch_set":47,"id":"3a50d1a3_395daa48","line":43,"in_reply_to":"3a50d1a3_310dcbe8","updated":"2015-07-31 21:31:31.000000000","message":"yep","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"99a8e51e8bba3291f7b20118fe500016df0ab8ac","unresolved":false,"context_lines":[{"line_number":52,"context_line":"----------------------"},{"line_number":53,"context_line":"Keystone Configuration"},{"line_number":54,"context_line":"----------------------"},{"line_number":55,"context_line":"The following configurable options can be defined in keystone.conf."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"    * ``trusted_issuer``"},{"line_number":58,"context_line":"        The list of trusted issuers to further filter the certificates"}],"source_content_type":"text/x-rst","patch_set":47,"id":"3a50d1a3_d1c34756","line":55,"updated":"2015-07-30 19:16:53.000000000","message":"end with colon instead?","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"288bb4dade83c0212c1f9f86638d0843b09cae40","unresolved":false,"context_lines":[{"line_number":52,"context_line":"----------------------"},{"line_number":53,"context_line":"Keystone Configuration"},{"line_number":54,"context_line":"----------------------"},{"line_number":55,"context_line":"The following configurable options can be defined in keystone.conf."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"    * ``trusted_issuer``"},{"line_number":58,"context_line":"        The list of trusted issuers to further filter the certificates"}],"source_content_type":"text/x-rst","patch_set":47,"id":"3a50d1a3_ff14d4e9","line":55,"in_reply_to":"3a50d1a3_d1c34756","updated":"2015-07-31 21:31:31.000000000","message":"done.","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"99a8e51e8bba3291f7b20118fe500016df0ab8ac","unresolved":false,"context_lines":[{"line_number":79,"context_line":"        in the corresponding mapping and this ephemeral user will have the"},{"line_number":80,"context_line":"        same roles as what are assigned to the group. It defaults to"},{"line_number":81,"context_line":"        ``false``."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"-------------"},{"line_number":84,"context_line":"Setup Mapping"},{"line_number":85,"context_line":"-------------"}],"source_content_type":"text/x-rst","patch_set":47,"id":"3a50d1a3_f1a1a396","line":82,"updated":"2015-07-30 19:16:53.000000000","message":"a sample of the keystone conf would be helpful here and also include the config group [tokenless_auth] too?","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"288bb4dade83c0212c1f9f86638d0843b09cae40","unresolved":false,"context_lines":[{"line_number":79,"context_line":"        in the corresponding mapping and this ephemeral user will have the"},{"line_number":80,"context_line":"        same roles as what are assigned to the group. It defaults to"},{"line_number":81,"context_line":"        ``false``."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"-------------"},{"line_number":84,"context_line":"Setup Mapping"},{"line_number":85,"context_line":"-------------"}],"source_content_type":"text/x-rst","patch_set":47,"id":"3a50d1a3_02b4c732","line":82,"in_reply_to":"3a50d1a3_f1a1a396","updated":"2015-07-31 21:31:31.000000000","message":"done.","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"99a8e51e8bba3291f7b20118fe500016df0ab8ac","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":".. code-block:: python"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"    issue_dn \u003d \u0027emailAddress\u003duserA@domainA.com,CN\u003duserA,OU\u003dprojectA,"},{"line_number":103,"context_line":"        O\u003ddomainA.com,L\u003dSunnyvale,ST\u003dCalifornia,C\u003dUS\u0027"},{"line_number":104,"context_line":"    hashed_idp \u003d hashlib.sha256(issue_dn)"},{"line_number":105,"context_line":"    idp_name \u003d hashed_idp.hexdigest()"}],"source_content_type":"text/x-rst","patch_set":47,"id":"3a50d1a3_71027374","line":102,"updated":"2015-07-30 19:16:53.000000000","message":"typo: issuer_dn\n\ndo we really need the emailAddress, location and street?\n\nSuggest to use a better example here than projectA or domainA.com","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"288bb4dade83c0212c1f9f86638d0843b09cae40","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":".. code-block:: python"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"    issue_dn \u003d \u0027emailAddress\u003duserA@domainA.com,CN\u003duserA,OU\u003dprojectA,"},{"line_number":103,"context_line":"        O\u003ddomainA.com,L\u003dSunnyvale,ST\u003dCalifornia,C\u003dUS\u0027"},{"line_number":104,"context_line":"    hashed_idp \u003d hashlib.sha256(issue_dn)"},{"line_number":105,"context_line":"    idp_name \u003d hashed_idp.hexdigest()"}],"source_content_type":"text/x-rst","patch_set":47,"id":"3a50d1a3_c291ff47","line":102,"in_reply_to":"3a50d1a3_71027374","updated":"2015-07-31 21:31:31.000000000","message":"not necessary but they are the common attributes in a certificate. \nST or S refers to \u0027state\u0027","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"99a8e51e8bba3291f7b20118fe500016df0ab8ac","unresolved":false,"context_lines":[{"line_number":136,"context_line":"            ]"},{"line_number":137,"context_line":"        }"},{"line_number":138,"context_line":"    }"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"However, if ``ephemeral_user`` is used, the mapping must yield at least one"},{"line_number":141,"context_line":"valid local group. For example:"},{"line_number":142,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"3a50d1a3_711033ac","line":139,"updated":"2015-07-30 19:16:53.000000000","message":"can you describe or give an example how the client certificate should be created to be able to map to an existing user?","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"288bb4dade83c0212c1f9f86638d0843b09cae40","unresolved":false,"context_lines":[{"line_number":136,"context_line":"            ]"},{"line_number":137,"context_line":"        }"},{"line_number":138,"context_line":"    }"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"However, if ``ephemeral_user`` is used, the mapping must yield at least one"},{"line_number":141,"context_line":"valid local group. For example:"},{"line_number":142,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"3a50d1a3_f54f1332","line":139,"in_reply_to":"3a50d1a3_711033ac","updated":"2015-07-31 21:31:31.000000000","message":"done.","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"99a8e51e8bba3291f7b20118fe500016df0ab8ac","unresolved":false,"context_lines":[{"line_number":173,"context_line":""},{"line_number":174,"context_line":"The name of the protocol will be the one defined in keystone.conf as protocol"},{"line_number":175,"context_line":"which defaults to ``x509``."},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"---------------------------"},{"line_number":178,"context_line":"Setup auth_token middleware"},{"line_number":179,"context_line":"---------------------------"}],"source_content_type":"text/x-rst","patch_set":47,"id":"3a50d1a3_b1755bfb","line":176,"updated":"2015-07-30 19:16:53.000000000","message":"should you mention something about IdP and mapping association when creating the protocol? to make it clearer for the reader","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"288bb4dade83c0212c1f9f86638d0843b09cae40","unresolved":false,"context_lines":[{"line_number":173,"context_line":""},{"line_number":174,"context_line":"The name of the protocol will be the one defined in keystone.conf as protocol"},{"line_number":175,"context_line":"which defaults to ``x509``."},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"---------------------------"},{"line_number":178,"context_line":"Setup auth_token middleware"},{"line_number":179,"context_line":"---------------------------"}],"source_content_type":"text/x-rst","patch_set":47,"id":"3a50d1a3_b5a3cbb0","line":176,"in_reply_to":"3a50d1a3_b1755bfb","updated":"2015-07-31 21:31:31.000000000","message":"done","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"afa73e0f8b7a198c1a22f345d5005af58bbf54c3","unresolved":false,"context_lines":[{"line_number":29,"context_line":"`apache-certificate-and-key-installation`_ as references for this setup."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":".. _`running-keystone-in-httpd`: http://docs.openstack.org/developer/keystone/apache-httpd.html"},{"line_number":32,"context_line":".. _`apache-certificate-and-key-installation`: https://www.digitalocean.com/community/tutorials/how-to-create-a-ssl-certificate-on-apache-for-ubuntu-14-04"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"--------------------"},{"line_number":35,"context_line":"Apache Configuration"}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_3500e4aa","line":32,"updated":"2015-08-12 04:26:21.000000000","message":"a link to a digital ocean how-to guide? *groan*","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"03e85143ccdc1c97ee94d14ac87aefcd7528ddf3","unresolved":false,"context_lines":[{"line_number":29,"context_line":"`apache-certificate-and-key-installation`_ as references for this setup."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":".. _`running-keystone-in-httpd`: http://docs.openstack.org/developer/keystone/apache-httpd.html"},{"line_number":32,"context_line":".. _`apache-certificate-and-key-installation`: https://www.digitalocean.com/community/tutorials/how-to-create-a-ssl-certificate-on-apache-for-ubuntu-14-04"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"--------------------"},{"line_number":35,"context_line":"Apache Configuration"}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_2f614c05","line":32,"in_reply_to":"1a4dcd0f_3500e4aa","updated":"2015-08-12 22:48:20.000000000","message":"yeah, this is a very generic setup, I stated this was out of the scope of this doc. But an example was asked from one of the previous comment and this link has pretty clear instruction on that, that\u0027s why it\u0027s here ..  ;-)","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"afa73e0f8b7a198c1a22f345d5005af58bbf54c3","unresolved":false,"context_lines":[{"line_number":52,"context_line":"----------------------"},{"line_number":53,"context_line":"Keystone Configuration"},{"line_number":54,"context_line":"----------------------"},{"line_number":55,"context_line":"The following configurable options can be defined in keystone.conf:"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"    * ``trusted_issuer``"},{"line_number":58,"context_line":"        The list of trusted issuers to further filter the certificates"}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_951e980a","line":55,"updated":"2015-08-12 04:26:21.000000000","message":"backticks around keystone.conf","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"03e85143ccdc1c97ee94d14ac87aefcd7528ddf3","unresolved":false,"context_lines":[{"line_number":52,"context_line":"----------------------"},{"line_number":53,"context_line":"Keystone Configuration"},{"line_number":54,"context_line":"----------------------"},{"line_number":55,"context_line":"The following configurable options can be defined in keystone.conf:"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"    * ``trusted_issuer``"},{"line_number":58,"context_line":"        The list of trusted issuers to further filter the certificates"}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_a29d73bd","line":55,"in_reply_to":"1a4dcd0f_951e980a","updated":"2015-08-12 22:48:20.000000000","message":"done","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"afa73e0f8b7a198c1a22f345d5005af58bbf54c3","unresolved":false,"context_lines":[{"line_number":54,"context_line":"----------------------"},{"line_number":55,"context_line":"The following configurable options can be defined in keystone.conf:"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"    * ``trusted_issuer``"},{"line_number":58,"context_line":"        The list of trusted issuers to further filter the certificates"},{"line_number":59,"context_line":"        that are allowed to participate in the X.509 tokenless authorization."},{"line_number":60,"context_line":"        If the option is absent then no certificates will be allowed. The"}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_551490e7","line":57,"updated":"2015-08-12 04:26:21.000000000","message":"these options are all unnecessarily indented","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"03e85143ccdc1c97ee94d14ac87aefcd7528ddf3","unresolved":false,"context_lines":[{"line_number":54,"context_line":"----------------------"},{"line_number":55,"context_line":"The following configurable options can be defined in keystone.conf:"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"    * ``trusted_issuer``"},{"line_number":58,"context_line":"        The list of trusted issuers to further filter the certificates"},{"line_number":59,"context_line":"        that are allowed to participate in the X.509 tokenless authorization."},{"line_number":60,"context_line":"        If the option is absent then no certificates will be allowed. The"}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_be44a346","line":57,"in_reply_to":"1a4dcd0f_551490e7","updated":"2015-08-12 22:48:20.000000000","message":"done","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"afa73e0f8b7a198c1a22f345d5005af58bbf54c3","unresolved":false,"context_lines":[{"line_number":80,"context_line":"        same roles as what are assigned to the group. It defaults to"},{"line_number":81,"context_line":"        ``false``."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"This is the sample configuration to have specified two trusted issuer and"},{"line_number":84,"context_line":"enabled ``ephemeral_user`` with ``protocol`` set to ``epemeral``."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_d5de603d","line":83,"updated":"2015-08-12 04:26:21.000000000","message":"how about:\n\n  This is a sample configuration for two `trusted_issuers`, a `protocol` set to `ephemeral`, and `ephemeral_user` set to ``True``.\n\nUse single backticks for keys, and double backticks for values.","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"03e85143ccdc1c97ee94d14ac87aefcd7528ddf3","unresolved":false,"context_lines":[{"line_number":80,"context_line":"        same roles as what are assigned to the group. It defaults to"},{"line_number":81,"context_line":"        ``false``."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"This is the sample configuration to have specified two trusted issuer and"},{"line_number":84,"context_line":"enabled ``ephemeral_user`` with ``protocol`` set to ``epemeral``."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_825b9785","line":83,"in_reply_to":"1a4dcd0f_d5de603d","updated":"2015-08-12 22:48:20.000000000","message":"done","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"108d338748c84d9499fea73c4b144151d1c59b05","unresolved":false,"context_lines":[{"line_number":81,"context_line":"        ``false``."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"This is the sample configuration to have specified two trusted issuer and"},{"line_number":84,"context_line":"enabled ``ephemeral_user`` with ``protocol`` set to ``epemeral``."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":".. code-block:: ini"},{"line_number":87,"context_line":""}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_921bea80","line":84,"updated":"2015-08-06 17:44:35.000000000","message":"s/epemeral/ephemeral/","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"cf794506f5cec679247e50d8e9a372e32b3a903c","unresolved":false,"context_lines":[{"line_number":81,"context_line":"        ``false``."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"This is the sample configuration to have specified two trusted issuer and"},{"line_number":84,"context_line":"enabled ``ephemeral_user`` with ``protocol`` set to ``epemeral``."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":".. code-block:: ini"},{"line_number":87,"context_line":""}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_025d4714","line":84,"in_reply_to":"1a4dcd0f_921bea80","updated":"2015-08-06 17:59:15.000000000","message":"will fix that","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"9444d01b2f81eeb97faf9e72072c2ffce55b43f2","unresolved":false,"context_lines":[{"line_number":104,"context_line":""},{"line_number":105,"context_line":"The name of the IdP will need to be created from the client issuer DN and"},{"line_number":106,"context_line":"it should contain no spaces and have the right order seperated by commas"},{"line_number":107,"context_line":"like the example below. Please be aware that ``emailAddress`` and ``ST``"},{"line_number":108,"context_line":"should be used instead of ``E`` and ``S`` that are shown on the certificate."},{"line_number":109,"context_line":"The following is the sample Python code used to create the IdP name."},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_4a8a9d1c","line":107,"updated":"2015-08-06 11:06:38.000000000","message":"does the order of attributes should be the same as in the example below?","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"6193f3e3282ba7a104ae8316a9da119179f10fb3","unresolved":false,"context_lines":[{"line_number":104,"context_line":""},{"line_number":105,"context_line":"The name of the IdP will need to be created from the client issuer DN and"},{"line_number":106,"context_line":"it should contain no spaces and have the right order seperated by commas"},{"line_number":107,"context_line":"like the example below. Please be aware that ``emailAddress`` and ``ST``"},{"line_number":108,"context_line":"should be used instead of ``E`` and ``S`` that are shown on the certificate."},{"line_number":109,"context_line":"The following is the sample Python code used to create the IdP name."},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_e3486ab5","line":107,"in_reply_to":"1a4dcd0f_4a8a9d1c","updated":"2015-08-06 15:12:38.000000000","message":"yes, the order should be exactly the same as what\u0027s on the certificate. After this patch is landed, we\u0027ll push another patch to enhance \"keystone-manage\" to make this easier.","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"afa73e0f8b7a198c1a22f345d5005af58bbf54c3","unresolved":false,"context_lines":[{"line_number":105,"context_line":"The name of the IdP will need to be created from the client issuer DN and"},{"line_number":106,"context_line":"it should contain no spaces and have the right order seperated by commas"},{"line_number":107,"context_line":"like the example below. Please be aware that ``emailAddress`` and ``ST``"},{"line_number":108,"context_line":"should be used instead of ``E`` and ``S`` that are shown on the certificate."},{"line_number":109,"context_line":"The following is the sample Python code used to create the IdP name."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":".. code-block:: python"}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_d583c001","line":108,"updated":"2015-08-12 04:26:21.000000000","message":"consider showing the certificate here, without one I have no idea what you are referring to when you say \"E\" and \"S\", even reading ahead and seeing the code, i still have no idea what you\u0027re talking about.","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"03e85143ccdc1c97ee94d14ac87aefcd7528ddf3","unresolved":false,"context_lines":[{"line_number":105,"context_line":"The name of the IdP will need to be created from the client issuer DN and"},{"line_number":106,"context_line":"it should contain no spaces and have the right order seperated by commas"},{"line_number":107,"context_line":"like the example below. Please be aware that ``emailAddress`` and ``ST``"},{"line_number":108,"context_line":"should be used instead of ``E`` and ``S`` that are shown on the certificate."},{"line_number":109,"context_line":"The following is the sample Python code used to create the IdP name."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":".. code-block:: python"}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_25164d4c","line":108,"in_reply_to":"1a4dcd0f_d583c001","updated":"2015-08-12 22:48:20.000000000","message":"good point and done.","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"afa73e0f8b7a198c1a22f345d5005af58bbf54c3","unresolved":false,"context_lines":[{"line_number":118,"context_line":"Create a Map"},{"line_number":119,"context_line":"------------"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"By default, ``ephemeral_user`` is not allowed. In this case, the mapping must"},{"line_number":122,"context_line":"yield a valid local user. When the client certificate has ``Subject DN`` as ``CN\u003dalex,OU\u003dengineering,O\u003dhp,L\u003dSunnyvale,ST\u003dCalifornia,C\u003dUS``, in the"},{"line_number":123,"context_line":"following examples, ``user_name`` will be mapped to``alex`` and ``domain_name``"},{"line_number":124,"context_line":"will be mapped to ``hp``."}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_b595d432","line":121,"updated":"2015-08-12 04:26:21.000000000","message":"``ephermeral_user`` is not allowed? it was a boolean just a few lines ago.","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"03e85143ccdc1c97ee94d14ac87aefcd7528ddf3","unresolved":false,"context_lines":[{"line_number":118,"context_line":"Create a Map"},{"line_number":119,"context_line":"------------"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"By default, ``ephemeral_user`` is not allowed. In this case, the mapping must"},{"line_number":122,"context_line":"yield a valid local user. When the client certificate has ``Subject DN`` as ``CN\u003dalex,OU\u003dengineering,O\u003dhp,L\u003dSunnyvale,ST\u003dCalifornia,C\u003dUS``, in the"},{"line_number":123,"context_line":"following examples, ``user_name`` will be mapped to``alex`` and ``domain_name``"},{"line_number":124,"context_line":"will be mapped to ``hp``."}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_9ee52739","line":121,"in_reply_to":"1a4dcd0f_b595d432","updated":"2015-08-12 22:48:20.000000000","message":"wrong wording, meant \u0027is set to  False` and fixed.","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"afa73e0f8b7a198c1a22f345d5005af58bbf54c3","unresolved":false,"context_lines":[{"line_number":123,"context_line":"following examples, ``user_name`` will be mapped to``alex`` and ``domain_name``"},{"line_number":124,"context_line":"will be mapped to ``hp``."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Please refer to `mod_ssl` for the detailed mapping attributes."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":".. _`mod_ssl`: http://httpd.apache.org/docs/current/mod/mod_ssl.html"},{"line_number":129,"context_line":""}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_55a7b0a6","line":126,"updated":"2015-08-12 04:26:21.000000000","message":"this isn\u0027t hyperlinked.","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"03e85143ccdc1c97ee94d14ac87aefcd7528ddf3","unresolved":false,"context_lines":[{"line_number":123,"context_line":"following examples, ``user_name`` will be mapped to``alex`` and ``domain_name``"},{"line_number":124,"context_line":"will be mapped to ``hp``."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Please refer to `mod_ssl` for the detailed mapping attributes."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":".. _`mod_ssl`: http://httpd.apache.org/docs/current/mod/mod_ssl.html"},{"line_number":129,"context_line":""}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_5e079fc9","line":126,"in_reply_to":"1a4dcd0f_55a7b0a6","updated":"2015-08-12 22:48:20.000000000","message":"good catch, fixed.","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"afa73e0f8b7a198c1a22f345d5005af58bbf54c3","unresolved":false,"context_lines":[{"line_number":188,"context_line":"Create a Protocol"},{"line_number":189,"context_line":"-----------------"},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"The name of the protocol will be the one defined in keystone.conf as protocol"},{"line_number":192,"context_line":"which defaults to ``x509``."},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"A protocol name and an IdP name will uniquely identify a mapping."}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_15bcc8b9","line":191,"updated":"2015-08-12 04:26:21.000000000","message":"`keystone.conf`","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"03e85143ccdc1c97ee94d14ac87aefcd7528ddf3","unresolved":false,"context_lines":[{"line_number":188,"context_line":"Create a Protocol"},{"line_number":189,"context_line":"-----------------"},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"The name of the protocol will be the one defined in keystone.conf as protocol"},{"line_number":192,"context_line":"which defaults to ``x509``."},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"A protocol name and an IdP name will uniquely identify a mapping."}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_ded08f21","line":191,"in_reply_to":"1a4dcd0f_15bcc8b9","updated":"2015-08-12 22:48:20.000000000","message":"done","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"afa73e0f8b7a198c1a22f345d5005af58bbf54c3","unresolved":false,"context_lines":[{"line_number":194,"context_line":"A protocol name and an IdP name will uniquely identify a mapping."},{"line_number":195,"context_line":""},{"line_number":196,"context_line":"---------------------------"},{"line_number":197,"context_line":"Setup auth_token middleware"},{"line_number":198,"context_line":"---------------------------"},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"Configurable Options"}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_f5dd9c14","line":197,"updated":"2015-08-12 04:26:21.000000000","message":"``auth_token``, yes, even in a title","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"afa73e0f8b7a198c1a22f345d5005af58bbf54c3","unresolved":false,"context_lines":[{"line_number":202,"context_line":"The following configurable options in ``auth_token`` middleware"},{"line_number":203,"context_line":"should set to the correct values:"},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"    * ``auth_protocol``"},{"line_number":206,"context_line":"        Sets to ``https``."},{"line_number":207,"context_line":"    * ``certfile``"},{"line_number":208,"context_line":"        Sets to the full path of the certificate file."}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_75f98c7f","line":205,"updated":"2015-08-12 04:26:21.000000000","message":"these are unnecessarily indented","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"03e85143ccdc1c97ee94d14ac87aefcd7528ddf3","unresolved":false,"context_lines":[{"line_number":202,"context_line":"The following configurable options in ``auth_token`` middleware"},{"line_number":203,"context_line":"should set to the correct values:"},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"    * ``auth_protocol``"},{"line_number":206,"context_line":"        Sets to ``https``."},{"line_number":207,"context_line":"    * ``certfile``"},{"line_number":208,"context_line":"        Sets to the full path of the certificate file."}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_1e8037f6","line":205,"in_reply_to":"1a4dcd0f_75f98c7f","updated":"2015-08-12 22:48:20.000000000","message":"done","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"afa73e0f8b7a198c1a22f345d5005af58bbf54c3","unresolved":false,"context_lines":[{"line_number":203,"context_line":"should set to the correct values:"},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"    * ``auth_protocol``"},{"line_number":206,"context_line":"        Sets to ``https``."},{"line_number":207,"context_line":"    * ``certfile``"},{"line_number":208,"context_line":"        Sets to the full path of the certificate file."},{"line_number":209,"context_line":"    * ``keyfile``"}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_35d8e41d","line":206,"updated":"2015-08-12 04:26:21.000000000","message":"Use \"Set\", not \"Sets\"","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"03e85143ccdc1c97ee94d14ac87aefcd7528ddf3","unresolved":false,"context_lines":[{"line_number":203,"context_line":"should set to the correct values:"},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"    * ``auth_protocol``"},{"line_number":206,"context_line":"        Sets to ``https``."},{"line_number":207,"context_line":"    * ``certfile``"},{"line_number":208,"context_line":"        Sets to the full path of the certificate file."},{"line_number":209,"context_line":"    * ``keyfile``"}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_3e83b304","line":206,"in_reply_to":"1a4dcd0f_35d8e41d","updated":"2015-08-12 22:48:20.000000000","message":"done","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"afa73e0f8b7a198c1a22f345d5005af58bbf54c3","unresolved":false,"context_lines":[{"line_number":216,"context_line":"The scope information will be passed from the headers with the following"},{"line_number":217,"context_line":"keywords to:"},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"    * ``X-Project-Id``"},{"line_number":220,"context_line":"        If specified, its the project scope."},{"line_number":221,"context_line":"    * ``X-Project-Name``"},{"line_number":222,"context_line":"        If specified, its the project scope."}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_95f6988d","line":219,"updated":"2015-08-12 04:26:21.000000000","message":"these are unnecessarily indented","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"03e85143ccdc1c97ee94d14ac87aefcd7528ddf3","unresolved":false,"context_lines":[{"line_number":216,"context_line":"The scope information will be passed from the headers with the following"},{"line_number":217,"context_line":"keywords to:"},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"    * ``X-Project-Id``"},{"line_number":220,"context_line":"        If specified, its the project scope."},{"line_number":221,"context_line":"    * ``X-Project-Name``"},{"line_number":222,"context_line":"        If specified, its the project scope."}],"source_content_type":"text/x-rst","patch_set":48,"id":"1a4dcd0f_fe79cb2f","line":219,"in_reply_to":"1a4dcd0f_95f6988d","updated":"2015-08-12 22:48:20.000000000","message":"done","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"960cb80720283eef0de77234e758267eb90a2d3d","unresolved":false,"context_lines":[{"line_number":76,"context_line":"  same roles as what are assigned to the group. It defaults to ``false``."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"This is a sample configuration for two `trusted_issuer`, a `protocol` set to"},{"line_number":79,"context_line":"``ephemeral``, and `ephemeral_user` set to ``True``."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":".. code-block:: ini"},{"line_number":82,"context_line":""}],"source_content_type":"text/x-rst","patch_set":50,"id":"fa1b9901_ca67a8b5","line":79,"updated":"2015-08-20 02:12:44.000000000","message":"why is the sample protocol set to ephemeral instead of x509?","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5c35fe32e246aaf52a8f5de28d61a87faea3a722","unresolved":false,"context_lines":[{"line_number":76,"context_line":"  same roles as what are assigned to the group. It defaults to ``false``."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"This is a sample configuration for two `trusted_issuer`, a `protocol` set to"},{"line_number":79,"context_line":"``ephemeral``, and `ephemeral_user` set to ``True``."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":".. code-block:: ini"},{"line_number":82,"context_line":""}],"source_content_type":"text/x-rst","patch_set":50,"id":"fa1b9901_34b202e6","line":79,"in_reply_to":"fa1b9901_ca67a8b5","updated":"2015-08-21 01:19:55.000000000","message":"this can be one or the other. Since we are setting x509 as the default, I just use ephemeral for the example.","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"960cb80720283eef0de77234e758267eb90a2d3d","unresolved":false,"context_lines":[{"line_number":84,"context_line":"    trusted_issuer \u003d emailAddress\u003dmary@cisco.com,CN\u003dmary,OU\u003dsale,O\u003dcisco,L\u003dSan Jose,ST\u003dCalifornia,C\u003dUS"},{"line_number":85,"context_line":"    trusted_issuer \u003d emailAddress\u003djohn@hp.com,CN\u003djohn,OU\u003dengineering,O\u003dhp,L\u003dSunnyvale,ST\u003dCalifornia,C\u003dUS"},{"line_number":86,"context_line":"    protocol \u003d ephemeral"},{"line_number":87,"context_line":"    ephemeral_user \u003d True"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"-------------"},{"line_number":90,"context_line":"Setup Mapping"}],"source_content_type":"text/x-rst","patch_set":50,"id":"fa1b9901_aae59438","line":87,"updated":"2015-08-20 02:12:44.000000000","message":"our keystone.conf seems to be using true (small \"T\")","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5c35fe32e246aaf52a8f5de28d61a87faea3a722","unresolved":false,"context_lines":[{"line_number":84,"context_line":"    trusted_issuer \u003d emailAddress\u003dmary@cisco.com,CN\u003dmary,OU\u003dsale,O\u003dcisco,L\u003dSan Jose,ST\u003dCalifornia,C\u003dUS"},{"line_number":85,"context_line":"    trusted_issuer \u003d emailAddress\u003djohn@hp.com,CN\u003djohn,OU\u003dengineering,O\u003dhp,L\u003dSunnyvale,ST\u003dCalifornia,C\u003dUS"},{"line_number":86,"context_line":"    protocol \u003d ephemeral"},{"line_number":87,"context_line":"    ephemeral_user \u003d True"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"-------------"},{"line_number":90,"context_line":"Setup Mapping"}],"source_content_type":"text/x-rst","patch_set":50,"id":"fa1b9901_8f4897cd","line":87,"in_reply_to":"fa1b9901_aae59438","updated":"2015-08-21 01:19:55.000000000","message":"One of the reviewed comments suggested to use lower case t \u0027true\u0027 in the comment.","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"960cb80720283eef0de77234e758267eb90a2d3d","unresolved":false,"context_lines":[{"line_number":105,"context_line":"    E\u003djohn@hp.com"},{"line_number":106,"context_line":"    CN\u003djohn"},{"line_number":107,"context_line":"    OU\u003dengineering"},{"line_number":108,"context_line":"    O\u003dhp"},{"line_number":109,"context_line":"    L\u003dSunnyvale"},{"line_number":110,"context_line":"    S\u003dCalifornia"},{"line_number":111,"context_line":"    C\u003dUS"}],"source_content_type":"text/x-rst","patch_set":50,"id":"fa1b9901_ead38c02","line":108,"updated":"2015-08-20 02:12:44.000000000","message":"the samples should be random rather than using HP :P","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5c35fe32e246aaf52a8f5de28d61a87faea3a722","unresolved":false,"context_lines":[{"line_number":105,"context_line":"    E\u003djohn@hp.com"},{"line_number":106,"context_line":"    CN\u003djohn"},{"line_number":107,"context_line":"    OU\u003dengineering"},{"line_number":108,"context_line":"    O\u003dhp"},{"line_number":109,"context_line":"    L\u003dSunnyvale"},{"line_number":110,"context_line":"    S\u003dCalifornia"},{"line_number":111,"context_line":"    C\u003dUS"}],"source_content_type":"text/x-rst","patch_set":50,"id":"fa1b9901_6f18a3d3","line":108,"in_reply_to":"fa1b9901_ead38c02","updated":"2015-08-21 01:19:55.000000000","message":"done.","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4c788126fa60aa52b961e499b650175ed9a26caf","unresolved":false,"context_lines":[{"line_number":112,"context_line":""},{"line_number":113,"context_line":"It should contain no spaces and have the right order seperated by commas"},{"line_number":114,"context_line":"like the example below. Please be aware that ``emailAddress`` and ``ST``"},{"line_number":115,"context_line":"should be used instead of ``E`` and ``S`` that are shown in the above"},{"line_number":116,"context_line":"example. The following is the sample Python code used to create the IdP"},{"line_number":117,"context_line":"name."},{"line_number":118,"context_line":""}],"source_content_type":"text/x-rst","patch_set":50,"id":"1a4dcd0f_a7830fca","line":115,"updated":"2015-08-13 16:00:24.000000000","message":"thanks for showing the example cert, just wondering why we have to use emailAdress and ST instead of E and S?","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"1c38f42539049bc777bcc2ecbe0fe3d831dad88a","unresolved":false,"context_lines":[{"line_number":112,"context_line":""},{"line_number":113,"context_line":"It should contain no spaces and have the right order seperated by commas"},{"line_number":114,"context_line":"like the example below. Please be aware that ``emailAddress`` and ``ST``"},{"line_number":115,"context_line":"should be used instead of ``E`` and ``S`` that are shown in the above"},{"line_number":116,"context_line":"example. The following is the sample Python code used to create the IdP"},{"line_number":117,"context_line":"name."},{"line_number":118,"context_line":""}],"source_content_type":"text/x-rst","patch_set":50,"id":"1a4dcd0f_a441c865","line":115,"in_reply_to":"1a4dcd0f_a7830fca","updated":"2015-08-13 17:15:30.000000000","message":"It\u0027s just in the request environment, it translates those two attributes to emailAddress and ST. I could have converted it back to E and S before building the IdP Id, but I rather to keep it as it is for now :-)","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"960cb80720283eef0de77234e758267eb90a2d3d","unresolved":false,"context_lines":[{"line_number":223,"context_line":""},{"line_number":224,"context_line":"* ``X-Project-Id`` - If specified, its the project scope."},{"line_number":225,"context_line":"* ``X-Project-Name`` - If specified, its the project scope."},{"line_number":226,"context_line":"* ``X-Project-Domain-Id`` - If specified, its the project scope."},{"line_number":227,"context_line":"* ``X-Project-Domain-Name`` - If specified, its the project scope."},{"line_number":228,"context_line":"* ``X-Domain-Id`` - If specified, its the domain scope."},{"line_number":229,"context_line":"* ``X-Domain-Name`` - If specified, its the domain scope."}],"source_content_type":"text/x-rst","patch_set":50,"id":"fa1b9901_4ab95878","line":226,"updated":"2015-08-20 02:12:44.000000000","message":"\"its the domain  of the project scope\"","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5c35fe32e246aaf52a8f5de28d61a87faea3a722","unresolved":false,"context_lines":[{"line_number":223,"context_line":""},{"line_number":224,"context_line":"* ``X-Project-Id`` - If specified, its the project scope."},{"line_number":225,"context_line":"* ``X-Project-Name`` - If specified, its the project scope."},{"line_number":226,"context_line":"* ``X-Project-Domain-Id`` - If specified, its the project scope."},{"line_number":227,"context_line":"* ``X-Project-Domain-Name`` - If specified, its the project scope."},{"line_number":228,"context_line":"* ``X-Domain-Id`` - If specified, its the domain scope."},{"line_number":229,"context_line":"* ``X-Domain-Name`` - If specified, its the domain scope."}],"source_content_type":"text/x-rst","patch_set":50,"id":"fa1b9901_8fe417ac","line":226,"in_reply_to":"fa1b9901_4ab95878","updated":"2015-08-21 01:19:55.000000000","message":"done","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"960cb80720283eef0de77234e758267eb90a2d3d","unresolved":false,"context_lines":[{"line_number":224,"context_line":"* ``X-Project-Id`` - If specified, its the project scope."},{"line_number":225,"context_line":"* ``X-Project-Name`` - If specified, its the project scope."},{"line_number":226,"context_line":"* ``X-Project-Domain-Id`` - If specified, its the project scope."},{"line_number":227,"context_line":"* ``X-Project-Domain-Name`` - If specified, its the project scope."},{"line_number":228,"context_line":"* ``X-Domain-Id`` - If specified, its the domain scope."},{"line_number":229,"context_line":"* ``X-Domain-Name`` - If specified, its the domain scope."}],"source_content_type":"text/x-rst","patch_set":50,"id":"fa1b9901_aaa83421","line":227,"updated":"2015-08-20 02:12:44.000000000","message":"\"its the domain  of the project scope\"","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5c35fe32e246aaf52a8f5de28d61a87faea3a722","unresolved":false,"context_lines":[{"line_number":224,"context_line":"* ``X-Project-Id`` - If specified, its the project scope."},{"line_number":225,"context_line":"* ``X-Project-Name`` - If specified, its the project scope."},{"line_number":226,"context_line":"* ``X-Project-Domain-Id`` - If specified, its the project scope."},{"line_number":227,"context_line":"* ``X-Project-Domain-Name`` - If specified, its the project scope."},{"line_number":228,"context_line":"* ``X-Domain-Id`` - If specified, its the domain scope."},{"line_number":229,"context_line":"* ``X-Domain-Name`` - If specified, its the domain scope."}],"source_content_type":"text/x-rst","patch_set":50,"id":"fa1b9901_afdf9bd4","line":227,"in_reply_to":"fa1b9901_aaa83421","updated":"2015-08-21 01:19:55.000000000","message":"done","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"c07aa71e62729635f59c653e13b216cfbd5587d5","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":51,"id":"fa1b9901_be5f6f74","updated":"2015-08-24 08:24:51.000000000","message":"explain that x509 is a special case of federated authn, so people know where to look for extra information. This docs doesn\u0027t explain how to setup, just gives some partial informatin without explaining \u0027what next\u0027.","commit_id":"572a18af0e8520b2fa284bc2f97410be1be96e7e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"a3198243d376815899b6d88deb82b97271a87cbe","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":51,"id":"fa1b9901_53c39057","in_reply_to":"fa1b9901_be5f6f74","updated":"2015-08-24 17:29:33.000000000","message":"ok, will try to add more details.","commit_id":"572a18af0e8520b2fa284bc2f97410be1be96e7e"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"c07aa71e62729635f59c653e13b216cfbd5587d5","unresolved":false,"context_lines":[{"line_number":41,"context_line":"to be passed. For example:"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":".. code-block:: ini"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"    SSLEngine on"},{"line_number":46,"context_line":"    SSLCertificateFile    /etc/apache2/ssl/apache.crt"},{"line_number":47,"context_line":"    SSLCertificateKeyFile /etc/apache2/ssl/apache.key"}],"source_content_type":"text/x-rst","patch_set":51,"id":"fa1b9901_decb431d","line":44,"updated":"2015-08-24 08:24:51.000000000","message":"add some reference that this is a snippet for \u003cVirtualHost\u003e configuration","commit_id":"572a18af0e8520b2fa284bc2f97410be1be96e7e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"a3198243d376815899b6d88deb82b97271a87cbe","unresolved":false,"context_lines":[{"line_number":41,"context_line":"to be passed. For example:"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":".. code-block:: ini"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"    SSLEngine on"},{"line_number":46,"context_line":"    SSLCertificateFile    /etc/apache2/ssl/apache.crt"},{"line_number":47,"context_line":"    SSLCertificateKeyFile /etc/apache2/ssl/apache.key"}],"source_content_type":"text/x-rst","patch_set":51,"id":"fa1b9901_f6dc121a","line":44,"in_reply_to":"fa1b9901_decb431d","updated":"2015-08-24 17:29:33.000000000","message":"maybe I just give a full configuration in this case.","commit_id":"572a18af0e8520b2fa284bc2f97410be1be96e7e"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"c07aa71e62729635f59c653e13b216cfbd5587d5","unresolved":false,"context_lines":[{"line_number":121,"context_line":"    issuer_dn \u003d \u0027emailAddress\u003djohn@openstack.com,CN\u003djohn,OU\u003dkeystone,"},{"line_number":122,"context_line":"        O\u003dopenstack,L\u003dSunnyvale,ST\u003dCalifornia,C\u003dUS\u0027"},{"line_number":123,"context_line":"    hashed_idp \u003d hashlib.sha256(issuer_dn)"},{"line_number":124,"context_line":"    idp_name \u003d hashed_idp.hexdigest()"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Create a Map"},{"line_number":127,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":51,"id":"fa1b9901_79081129","line":124,"updated":"2015-08-24 08:24:51.000000000","message":"so it\u0027s one IdP *per* user?","commit_id":"572a18af0e8520b2fa284bc2f97410be1be96e7e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"a3198243d376815899b6d88deb82b97271a87cbe","unresolved":false,"context_lines":[{"line_number":121,"context_line":"    issuer_dn \u003d \u0027emailAddress\u003djohn@openstack.com,CN\u003djohn,OU\u003dkeystone,"},{"line_number":122,"context_line":"        O\u003dopenstack,L\u003dSunnyvale,ST\u003dCalifornia,C\u003dUS\u0027"},{"line_number":123,"context_line":"    hashed_idp \u003d hashlib.sha256(issuer_dn)"},{"line_number":124,"context_line":"    idp_name \u003d hashed_idp.hexdigest()"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Create a Map"},{"line_number":127,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":51,"id":"fa1b9901_f373c4b2","line":124,"in_reply_to":"fa1b9901_44743dce","updated":"2015-08-24 17:29:33.000000000","message":"Boris is right about that. An issuer can issue as many client certificates to it\u0027s clients as it needs to and one issuer refers to one IdP.","commit_id":"572a18af0e8520b2fa284bc2f97410be1be96e7e"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"96eddc4f1e14b6bc322dd95d6b0db748c05aa5e0","unresolved":false,"context_lines":[{"line_number":121,"context_line":"    issuer_dn \u003d \u0027emailAddress\u003djohn@openstack.com,CN\u003djohn,OU\u003dkeystone,"},{"line_number":122,"context_line":"        O\u003dopenstack,L\u003dSunnyvale,ST\u003dCalifornia,C\u003dUS\u0027"},{"line_number":123,"context_line":"    hashed_idp \u003d hashlib.sha256(issuer_dn)"},{"line_number":124,"context_line":"    idp_name \u003d hashed_idp.hexdigest()"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Create a Map"},{"line_number":127,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":51,"id":"fa1b9901_44743dce","line":124,"in_reply_to":"fa1b9901_79081129","updated":"2015-08-24 10:22:05.000000000","message":"No. That\u0027s one IDP per issuer. An issuer issues certificates for multiple clients. Although I agree, the instructions could be a bit more explicit.","commit_id":"572a18af0e8520b2fa284bc2f97410be1be96e7e"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"c07aa71e62729635f59c653e13b216cfbd5587d5","unresolved":false,"context_lines":[{"line_number":122,"context_line":"        O\u003dopenstack,L\u003dSunnyvale,ST\u003dCalifornia,C\u003dUS\u0027"},{"line_number":123,"context_line":"    hashed_idp \u003d hashlib.sha256(issuer_dn)"},{"line_number":124,"context_line":"    idp_name \u003d hashed_idp.hexdigest()"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Create a Map"},{"line_number":127,"context_line":"------------"},{"line_number":128,"context_line":""}],"source_content_type":"text/x-rst","patch_set":51,"id":"fa1b9901_de2fc3f4","line":125,"updated":"2015-08-24 08:24:51.000000000","message":"this documentation does not explain how to really setup this. You pasted some code snippet and don\u0027t tell the user what do do with that? Is it okay if I save it in my /tmp? \nI don\u0027t see what I am supposed to do (from the very beginning to the very end) and why i should do this.","commit_id":"572a18af0e8520b2fa284bc2f97410be1be96e7e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"a3198243d376815899b6d88deb82b97271a87cbe","unresolved":false,"context_lines":[{"line_number":122,"context_line":"        O\u003dopenstack,L\u003dSunnyvale,ST\u003dCalifornia,C\u003dUS\u0027"},{"line_number":123,"context_line":"    hashed_idp \u003d hashlib.sha256(issuer_dn)"},{"line_number":124,"context_line":"    idp_name \u003d hashed_idp.hexdigest()"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Create a Map"},{"line_number":127,"context_line":"------------"},{"line_number":128,"context_line":""}],"source_content_type":"text/x-rst","patch_set":51,"id":"fa1b9901_56d61ef2","line":125,"in_reply_to":"fa1b9901_de2fc3f4","updated":"2015-08-24 17:29:33.000000000","message":"will give more details.","commit_id":"572a18af0e8520b2fa284bc2f97410be1be96e7e"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"c07aa71e62729635f59c653e13b216cfbd5587d5","unresolved":false,"context_lines":[{"line_number":193,"context_line":"            ]"},{"line_number":194,"context_line":"        }"},{"line_number":195,"context_line":"    }"},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"Create a Protocol"},{"line_number":198,"context_line":"-----------------"},{"line_number":199,"context_line":""}],"source_content_type":"text/x-rst","patch_set":51,"id":"fa1b9901_fe2e47a4","line":196,"updated":"2015-08-24 08:24:51.000000000","message":"and what next with the mapping ?","commit_id":"572a18af0e8520b2fa284bc2f97410be1be96e7e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"a3198243d376815899b6d88deb82b97271a87cbe","unresolved":false,"context_lines":[{"line_number":193,"context_line":"            ]"},{"line_number":194,"context_line":"        }"},{"line_number":195,"context_line":"    }"},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"Create a Protocol"},{"line_number":198,"context_line":"-----------------"},{"line_number":199,"context_line":""}],"source_content_type":"text/x-rst","patch_set":51,"id":"fa1b9901_b6fd3a70","line":196,"in_reply_to":"fa1b9901_fe2e47a4","updated":"2015-08-24 17:29:33.000000000","message":"will give more details.","commit_id":"572a18af0e8520b2fa284bc2f97410be1be96e7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18e1f6d929399c37afba2d62f138238541c71973","unresolved":false,"context_lines":[{"line_number":33,"context_line":"as references for this setup."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":".. _`running-keystone-in-httpd`: http://docs.openstack.org/developer/keystone/apache-httpd.html"},{"line_number":36,"context_line":".. _`apache-certificate-and-key-installation`: https://www.digitalocean.com/community/tutorials/how-to-create-a-ssl-certificate-on-apache-for-ubuntu-14-04"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"--------------------"},{"line_number":39,"context_line":"Apache Configuration"}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_02ee6b8b","line":36,"updated":"2015-08-26 18:34:25.000000000","message":"do we have links to our own docs for this?","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5a38c16026ca6a7252db7a0c48d38dd29ef7e852","unresolved":false,"context_lines":[{"line_number":33,"context_line":"as references for this setup."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":".. _`running-keystone-in-httpd`: http://docs.openstack.org/developer/keystone/apache-httpd.html"},{"line_number":36,"context_line":".. _`apache-certificate-and-key-installation`: https://www.digitalocean.com/community/tutorials/how-to-create-a-ssl-certificate-on-apache-for-ubuntu-14-04"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"--------------------"},{"line_number":39,"context_line":"Apache Configuration"}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_8c206a4b","line":36,"in_reply_to":"da20952f_02ee6b8b","updated":"2015-08-27 03:51:32.000000000","message":"no, this is basically very generic instructions on how to setup https with apache; it can be found easily from googling. But this link seems to be better organized and easy to follow, and one of the comments suggested to include it, so ... it\u0027s here :-)","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18e1f6d929399c37afba2d62f138238541c71973","unresolved":false,"context_lines":[{"line_number":39,"context_line":"Apache Configuration"},{"line_number":40,"context_line":"--------------------"},{"line_number":41,"context_line":"To enable X.509 tokenless authorization, SSL has to be enabled and configured"},{"line_number":42,"context_line":"in the Apache virtual host file. Client authentication (``SSLVerifyClient``)"},{"line_number":43,"context_line":"should be set as ``optional`` to allow other token authentication methods."},{"line_number":44,"context_line":"And attribute ``SSLOptions`` needs to set as ``+StdEnvVars`` to allow"},{"line_number":45,"context_line":"certificate attributes to be passed. The following is the sample virtual host"}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_e202576f","line":42,"updated":"2015-08-26 18:34:25.000000000","message":"doesn\u0027t this fall under \"Prerequisites\"?","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5a38c16026ca6a7252db7a0c48d38dd29ef7e852","unresolved":false,"context_lines":[{"line_number":39,"context_line":"Apache Configuration"},{"line_number":40,"context_line":"--------------------"},{"line_number":41,"context_line":"To enable X.509 tokenless authorization, SSL has to be enabled and configured"},{"line_number":42,"context_line":"in the Apache virtual host file. Client authentication (``SSLVerifyClient``)"},{"line_number":43,"context_line":"should be set as ``optional`` to allow other token authentication methods."},{"line_number":44,"context_line":"And attribute ``SSLOptions`` needs to set as ``+StdEnvVars`` to allow"},{"line_number":45,"context_line":"certificate attributes to be passed. The following is the sample virtual host"}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_6cc1562e","line":42,"in_reply_to":"da20952f_e202576f","updated":"2015-08-27 03:51:32.000000000","message":"Couple of these options are explicitly required for this tokenless, so I think it makes more sense to have a separated session for that.","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18e1f6d929399c37afba2d62f138238541c71973","unresolved":false,"context_lines":[{"line_number":63,"context_line":"----------------------"},{"line_number":64,"context_line":"Keystone Configuration"},{"line_number":65,"context_line":"----------------------"},{"line_number":66,"context_line":"The following configurable options can be defined in `keystone.conf`:"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"* ``trusted_issuer`` - The list of trusted issuers to further filter the"},{"line_number":69,"context_line":"  certificates that are allowed to participate in the X.509 tokenless"}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_c234f34b","line":66,"updated":"2015-08-26 18:34:25.000000000","message":"nit: s/configurable//","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5a38c16026ca6a7252db7a0c48d38dd29ef7e852","unresolved":false,"context_lines":[{"line_number":63,"context_line":"----------------------"},{"line_number":64,"context_line":"Keystone Configuration"},{"line_number":65,"context_line":"----------------------"},{"line_number":66,"context_line":"The following configurable options can be defined in `keystone.conf`:"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"* ``trusted_issuer`` - The list of trusted issuers to further filter the"},{"line_number":69,"context_line":"  certificates that are allowed to participate in the X.509 tokenless"}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_acce8e58","line":66,"in_reply_to":"da20952f_c234f34b","updated":"2015-08-27 03:51:32.000000000","message":"done.","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18e1f6d929399c37afba2d62f138238541c71973","unresolved":false,"context_lines":[{"line_number":100,"context_line":"to the issuer of the X.509 SSL client certificate. The protocol for the"},{"line_number":101,"context_line":"given identity is ``x509`` by default, but can be configurable."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"Create an IdP"},{"line_number":104,"context_line":"-------------"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"In order to create an IdP, the issuer DN in the client certificate needs"}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_82db5bed","line":103,"updated":"2015-08-26 18:34:25.000000000","message":"Identity Provider* \n\nonly because this is documentation that will be referenced by users and they might not know what \u0027IdP\u0027 stands for.","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5a38c16026ca6a7252db7a0c48d38dd29ef7e852","unresolved":false,"context_lines":[{"line_number":100,"context_line":"to the issuer of the X.509 SSL client certificate. The protocol for the"},{"line_number":101,"context_line":"given identity is ``x509`` by default, but can be configurable."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"Create an IdP"},{"line_number":104,"context_line":"-------------"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"In order to create an IdP, the issuer DN in the client certificate needs"}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_8c3f0a25","line":103,"in_reply_to":"da20952f_82db5bed","updated":"2015-08-27 03:51:32.000000000","message":"good point. done.","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18e1f6d929399c37afba2d62f138238541c71973","unresolved":false,"context_lines":[{"line_number":222,"context_line":""},{"line_number":223,"context_line":".. code-block:: bash"},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"    curl -k -s -H \"X-Auth-Token: \u003cTOKEN\u003e\" -H \"Content-Type: application/json\" -d \u0027{\"mapping\": {\"rules\": [{\"local\": [{\"user\": {\"name\": \"{0}\",\"type\": \"ephemeral\"}},{\"group\": {\"id\": \"\u003cGROUPID\u003e\"}}],\"remote\": [{\"type\": \"SSL_CLIENT_S_DN_CN\"}]}]}}\u0027 -X PUT https://\u003cHOSTNAME\u003e:\u003cPORT\u003e/v3/OS-FEDERATION/mappings/\u003cMAPPING ID\u003e"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":""},{"line_number":228,"context_line":""}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_825efb43","line":225,"updated":"2015-08-26 18:34:25.000000000","message":"suggest breaking this up a bit so that it reads a little easier; \n\n    .. code-block: bash \n    \n        curl -k -s -H \"X-Auth-Token: \u003cTOKEN\u003e\" \\\n             -H \"Content-Type: application/json\" \\\n             -d \u0027$MAPPING\u0027 \\ \n             -X PUT https://\u003cHOSTNAME\u003e:\u003cPORT\u003e/v3/OS-FEDERATION/mappings\n/\u003cMAPPING ID\u003e","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5a38c16026ca6a7252db7a0c48d38dd29ef7e852","unresolved":false,"context_lines":[{"line_number":222,"context_line":""},{"line_number":223,"context_line":".. code-block:: bash"},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"    curl -k -s -H \"X-Auth-Token: \u003cTOKEN\u003e\" -H \"Content-Type: application/json\" -d \u0027{\"mapping\": {\"rules\": [{\"local\": [{\"user\": {\"name\": \"{0}\",\"type\": \"ephemeral\"}},{\"group\": {\"id\": \"\u003cGROUPID\u003e\"}}],\"remote\": [{\"type\": \"SSL_CLIENT_S_DN_CN\"}]}]}}\u0027 -X PUT https://\u003cHOSTNAME\u003e:\u003cPORT\u003e/v3/OS-FEDERATION/mappings/\u003cMAPPING ID\u003e"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":""},{"line_number":228,"context_line":""}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_cc11825f","line":225,"in_reply_to":"da20952f_825efb43","updated":"2015-08-27 03:51:32.000000000","message":"good point. done.","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"aa571a90b38ed2d0133cf69533812ca0d4d3aa8c","unresolved":false,"context_lines":[{"line_number":223,"context_line":".. code-block:: bash"},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"    curl -k -s -H \"X-Auth-Token: \u003cTOKEN\u003e\" -H \"Content-Type: application/json\" -d \u0027{\"mapping\": {\"rules\": [{\"local\": [{\"user\": {\"name\": \"{0}\",\"type\": \"ephemeral\"}},{\"group\": {\"id\": \"\u003cGROUPID\u003e\"}}],\"remote\": [{\"type\": \"SSL_CLIENT_S_DN_CN\"}]}]}}\u0027 -X PUT https://\u003cHOSTNAME\u003e:\u003cPORT\u003e/v3/OS-FEDERATION/mappings/\u003cMAPPING ID\u003e"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":""},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"Create a Protocol"}],"source_content_type":"text/x-rst","patch_set":55,"id":"fa1b9901_0a132eb9","line":226,"updated":"2015-08-26 14:04:48.000000000","message":"maybe say for the mapping the mapping_id is really user degined and doesn\u0027t matter, as opposed to idp_id.","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5a38c16026ca6a7252db7a0c48d38dd29ef7e852","unresolved":false,"context_lines":[{"line_number":223,"context_line":".. code-block:: bash"},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"    curl -k -s -H \"X-Auth-Token: \u003cTOKEN\u003e\" -H \"Content-Type: application/json\" -d \u0027{\"mapping\": {\"rules\": [{\"local\": [{\"user\": {\"name\": \"{0}\",\"type\": \"ephemeral\"}},{\"group\": {\"id\": \"\u003cGROUPID\u003e\"}}],\"remote\": [{\"type\": \"SSL_CLIENT_S_DN_CN\"}]}]}}\u0027 -X PUT https://\u003cHOSTNAME\u003e:\u003cPORT\u003e/v3/OS-FEDERATION/mappings/\u003cMAPPING ID\u003e"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":""},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"Create a Protocol"}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_47bead00","line":226,"in_reply_to":"fa1b9901_0a132eb9","updated":"2015-08-27 03:51:32.000000000","message":"done.","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18e1f6d929399c37afba2d62f138238541c71973","unresolved":false,"context_lines":[{"line_number":232,"context_line":"The name of the protocol will be the one defined in `keystone.conf` as"},{"line_number":233,"context_line":"``protocol`` which defaults to ``x509``."},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"A protocol name and an IdP Id will uniquely identify a mapping."},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"The following sample curl command should be sent to keystone to create a"},{"line_number":238,"context_line":"protocol with the provided protocol name that is defined in `keystone.conf`."}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_e23fb7d4","line":235,"updated":"2015-08-26 18:34:25.000000000","message":"ID","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5a38c16026ca6a7252db7a0c48d38dd29ef7e852","unresolved":false,"context_lines":[{"line_number":232,"context_line":"The name of the protocol will be the one defined in `keystone.conf` as"},{"line_number":233,"context_line":"``protocol`` which defaults to ``x509``."},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"A protocol name and an IdP Id will uniquely identify a mapping."},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"The following sample curl command should be sent to keystone to create a"},{"line_number":238,"context_line":"protocol with the provided protocol name that is defined in `keystone.conf`."}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_c70b9d7c","line":235,"in_reply_to":"da20952f_e23fb7d4","updated":"2015-08-27 03:51:32.000000000","message":"done.","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18e1f6d929399c37afba2d62f138238541c71973","unresolved":false,"context_lines":[{"line_number":239,"context_line":""},{"line_number":240,"context_line":".. code-block:: bash"},{"line_number":241,"context_line":""},{"line_number":242,"context_line":"curl -k -s -H \"X-Auth-Token: \u003cTOKEN\u003e\" -H \"Content-Type: application/json\" -d \u0027{\"protocol\": {\"mapping_id\": \"\u003cMAPPING ID\u003e\"}}\u0027 -X PUT https://\u003cHOSTNAME\u003e:\u003cPORT\u003e/v3/OS-FEDERATION/identity_providers/\u003cIdP ID\u003e/protocols/\u003cPROTOCOL NAME\u003e"},{"line_number":243,"context_line":""},{"line_number":244,"context_line":"-------------------------------"},{"line_number":245,"context_line":"Setup ``auth_token`` middleware"}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_22360f04","line":242,"updated":"2015-08-26 18:34:25.000000000","message":"same comment here","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5a38c16026ca6a7252db7a0c48d38dd29ef7e852","unresolved":false,"context_lines":[{"line_number":239,"context_line":""},{"line_number":240,"context_line":".. code-block:: bash"},{"line_number":241,"context_line":""},{"line_number":242,"context_line":"curl -k -s -H \"X-Auth-Token: \u003cTOKEN\u003e\" -H \"Content-Type: application/json\" -d \u0027{\"protocol\": {\"mapping_id\": \"\u003cMAPPING ID\u003e\"}}\u0027 -X PUT https://\u003cHOSTNAME\u003e:\u003cPORT\u003e/v3/OS-FEDERATION/identity_providers/\u003cIdP ID\u003e/protocols/\u003cPROTOCOL NAME\u003e"},{"line_number":243,"context_line":""},{"line_number":244,"context_line":"-------------------------------"},{"line_number":245,"context_line":"Setup ``auth_token`` middleware"}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_e43ed1b7","line":242,"in_reply_to":"da20952f_22360f04","updated":"2015-08-27 03:51:32.000000000","message":"done","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"aa571a90b38ed2d0133cf69533812ca0d4d3aa8c","unresolved":false,"context_lines":[{"line_number":240,"context_line":".. code-block:: bash"},{"line_number":241,"context_line":""},{"line_number":242,"context_line":"curl -k -s -H \"X-Auth-Token: \u003cTOKEN\u003e\" -H \"Content-Type: application/json\" -d \u0027{\"protocol\": {\"mapping_id\": \"\u003cMAPPING ID\u003e\"}}\u0027 -X PUT https://\u003cHOSTNAME\u003e:\u003cPORT\u003e/v3/OS-FEDERATION/identity_providers/\u003cIdP ID\u003e/protocols/\u003cPROTOCOL NAME\u003e"},{"line_number":243,"context_line":""},{"line_number":244,"context_line":"-------------------------------"},{"line_number":245,"context_line":"Setup ``auth_token`` middleware"},{"line_number":246,"context_line":"-------------------------------"}],"source_content_type":"text/x-rst","patch_set":55,"id":"fa1b9901_2a663251","line":243,"updated":"2015-08-26 14:04:48.000000000","message":"same for PROTOCOL_NAME","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5a38c16026ca6a7252db7a0c48d38dd29ef7e852","unresolved":false,"context_lines":[{"line_number":240,"context_line":".. code-block:: bash"},{"line_number":241,"context_line":""},{"line_number":242,"context_line":"curl -k -s -H \"X-Auth-Token: \u003cTOKEN\u003e\" -H \"Content-Type: application/json\" -d \u0027{\"protocol\": {\"mapping_id\": \"\u003cMAPPING ID\u003e\"}}\u0027 -X PUT https://\u003cHOSTNAME\u003e:\u003cPORT\u003e/v3/OS-FEDERATION/identity_providers/\u003cIdP ID\u003e/protocols/\u003cPROTOCOL NAME\u003e"},{"line_number":243,"context_line":""},{"line_number":244,"context_line":"-------------------------------"},{"line_number":245,"context_line":"Setup ``auth_token`` middleware"},{"line_number":246,"context_line":"-------------------------------"}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_44745d9b","line":243,"in_reply_to":"fa1b9901_2a663251","updated":"2015-08-27 03:51:32.000000000","message":"done","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18e1f6d929399c37afba2d62f138238541c71973","unresolved":false,"context_lines":[{"line_number":243,"context_line":""},{"line_number":244,"context_line":"-------------------------------"},{"line_number":245,"context_line":"Setup ``auth_token`` middleware"},{"line_number":246,"context_line":"-------------------------------"},{"line_number":247,"context_line":"In order to use ``auth_token`` middleware as the service client for X.509"},{"line_number":248,"context_line":"tokenless authorization, both configurable options and scope information"},{"line_number":249,"context_line":"will need to be setup."}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_622c07ac","line":246,"updated":"2015-08-26 18:34:25.000000000","message":"add a new line here","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5a38c16026ca6a7252db7a0c48d38dd29ef7e852","unresolved":false,"context_lines":[{"line_number":243,"context_line":""},{"line_number":244,"context_line":"-------------------------------"},{"line_number":245,"context_line":"Setup ``auth_token`` middleware"},{"line_number":246,"context_line":"-------------------------------"},{"line_number":247,"context_line":"In order to use ``auth_token`` middleware as the service client for X.509"},{"line_number":248,"context_line":"tokenless authorization, both configurable options and scope information"},{"line_number":249,"context_line":"will need to be setup."}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_c4962d94","line":246,"in_reply_to":"da20952f_622c07ac","updated":"2015-08-27 03:51:32.000000000","message":"done","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18e1f6d929399c37afba2d62f138238541c71973","unresolved":false,"context_lines":[{"line_number":249,"context_line":"will need to be setup."},{"line_number":250,"context_line":""},{"line_number":251,"context_line":"Configurable Options"},{"line_number":252,"context_line":"--------------------"},{"line_number":253,"context_line":"The following configurable options in ``auth_token`` middleware"},{"line_number":254,"context_line":"should set to the correct values:"},{"line_number":255,"context_line":""}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_e216d754","line":252,"updated":"2015-08-26 18:34:25.000000000","message":"add a new line here","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5a38c16026ca6a7252db7a0c48d38dd29ef7e852","unresolved":false,"context_lines":[{"line_number":249,"context_line":"will need to be setup."},{"line_number":250,"context_line":""},{"line_number":251,"context_line":"Configurable Options"},{"line_number":252,"context_line":"--------------------"},{"line_number":253,"context_line":"The following configurable options in ``auth_token`` middleware"},{"line_number":254,"context_line":"should set to the correct values:"},{"line_number":255,"context_line":""}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_a48d397d","line":252,"in_reply_to":"da20952f_e216d754","updated":"2015-08-27 03:51:32.000000000","message":"done","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18e1f6d929399c37afba2d62f138238541c71973","unresolved":false,"context_lines":[{"line_number":259,"context_line":"* ``cafile`` - Set to the full path of the trusted CA certificate file."},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"Scope Information"},{"line_number":262,"context_line":"-----------------"},{"line_number":263,"context_line":"The scope information will be passed from the headers with the following"},{"line_number":264,"context_line":"keywords to:"},{"line_number":265,"context_line":""}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_4206a321","line":262,"updated":"2015-08-26 18:34:25.000000000","message":"add a new line here","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5a38c16026ca6a7252db7a0c48d38dd29ef7e852","unresolved":false,"context_lines":[{"line_number":259,"context_line":"* ``cafile`` - Set to the full path of the trusted CA certificate file."},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"Scope Information"},{"line_number":262,"context_line":"-----------------"},{"line_number":263,"context_line":"The scope information will be passed from the headers with the following"},{"line_number":264,"context_line":"keywords to:"},{"line_number":265,"context_line":""}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_64ee4124","line":262,"in_reply_to":"da20952f_4206a321","updated":"2015-08-27 03:51:32.000000000","message":"done","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18e1f6d929399c37afba2d62f138238541c71973","unresolved":false,"context_lines":[{"line_number":272,"context_line":""},{"line_number":273,"context_line":"---------------------"},{"line_number":274,"context_line":"Test It Out with cURL"},{"line_number":275,"context_line":"---------------------"},{"line_number":276,"context_line":"Once the above configurations have been setup, the following curl command can"},{"line_number":277,"context_line":"be used for token validation."},{"line_number":278,"context_line":""}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_05ff5502","line":275,"updated":"2015-08-26 18:34:25.000000000","message":"add a new line here","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5a38c16026ca6a7252db7a0c48d38dd29ef7e852","unresolved":false,"context_lines":[{"line_number":272,"context_line":""},{"line_number":273,"context_line":"---------------------"},{"line_number":274,"context_line":"Test It Out with cURL"},{"line_number":275,"context_line":"---------------------"},{"line_number":276,"context_line":"Once the above configurations have been setup, the following curl command can"},{"line_number":277,"context_line":"be used for token validation."},{"line_number":278,"context_line":""}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_24f849e5","line":275,"in_reply_to":"da20952f_05ff5502","updated":"2015-08-27 03:51:32.000000000","message":"done","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18e1f6d929399c37afba2d62f138238541c71973","unresolved":false,"context_lines":[{"line_number":278,"context_line":""},{"line_number":279,"context_line":".. code-block:: bash"},{"line_number":280,"context_line":""},{"line_number":281,"context_line":"curl -v -k -s -X GET --cert /\u003cPATH\u003e/x509client.crt --key /\u003cPATH\u003e/x509client.key --cacert /\u003cPATH\u003e/ca.crt -H \"X-Project-Name: \u003cPROJECT-NAME\u003e\" -H \"X-Project-Domain-Id: \u003cPROJECT-DOMAIN-ID\u003e\" -H \"X-Subject-Token: \u003cTOKEN\u003e\" https://\u003cHOST\u003e:\u003cPORT\u003e/v3/auth/tokens | python -mjson.tool"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":"Details of the Options"},{"line_number":284,"context_line":"----------------------"}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_e50d8138","line":281,"updated":"2015-08-26 18:34:25.000000000","message":"same comment applies to this curl command","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5a38c16026ca6a7252db7a0c48d38dd29ef7e852","unresolved":false,"context_lines":[{"line_number":278,"context_line":""},{"line_number":279,"context_line":".. code-block:: bash"},{"line_number":280,"context_line":""},{"line_number":281,"context_line":"curl -v -k -s -X GET --cert /\u003cPATH\u003e/x509client.crt --key /\u003cPATH\u003e/x509client.key --cacert /\u003cPATH\u003e/ca.crt -H \"X-Project-Name: \u003cPROJECT-NAME\u003e\" -H \"X-Project-Domain-Id: \u003cPROJECT-DOMAIN-ID\u003e\" -H \"X-Subject-Token: \u003cTOKEN\u003e\" https://\u003cHOST\u003e:\u003cPORT\u003e/v3/auth/tokens | python -mjson.tool"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":"Details of the Options"},{"line_number":284,"context_line":"----------------------"}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_04cae5a1","line":281,"in_reply_to":"da20952f_e50d8138","updated":"2015-08-27 03:51:32.000000000","message":"done","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18e1f6d929399c37afba2d62f138238541c71973","unresolved":false,"context_lines":[{"line_number":281,"context_line":"curl -v -k -s -X GET --cert /\u003cPATH\u003e/x509client.crt --key /\u003cPATH\u003e/x509client.key --cacert /\u003cPATH\u003e/ca.crt -H \"X-Project-Name: \u003cPROJECT-NAME\u003e\" -H \"X-Project-Domain-Id: \u003cPROJECT-DOMAIN-ID\u003e\" -H \"X-Subject-Token: \u003cTOKEN\u003e\" https://\u003cHOST\u003e:\u003cPORT\u003e/v3/auth/tokens | python -mjson.tool"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":"Details of the Options"},{"line_number":284,"context_line":"----------------------"},{"line_number":285,"context_line":"* ``--cert`` - The client certificate that will be presented to Keystone."},{"line_number":286,"context_line":"  The ``Issuer`` in the certificate along with the defined ``protocol``"},{"line_number":287,"context_line":"  in `keystone.conf` will uniquely identify the mapping. The ``Subject``"}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_2504d913","line":284,"updated":"2015-08-26 18:34:25.000000000","message":"add a new line here","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5a38c16026ca6a7252db7a0c48d38dd29ef7e852","unresolved":false,"context_lines":[{"line_number":281,"context_line":"curl -v -k -s -X GET --cert /\u003cPATH\u003e/x509client.crt --key /\u003cPATH\u003e/x509client.key --cacert /\u003cPATH\u003e/ca.crt -H \"X-Project-Name: \u003cPROJECT-NAME\u003e\" -H \"X-Project-Domain-Id: \u003cPROJECT-DOMAIN-ID\u003e\" -H \"X-Subject-Token: \u003cTOKEN\u003e\" https://\u003cHOST\u003e:\u003cPORT\u003e/v3/auth/tokens | python -mjson.tool"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":"Details of the Options"},{"line_number":284,"context_line":"----------------------"},{"line_number":285,"context_line":"* ``--cert`` - The client certificate that will be presented to Keystone."},{"line_number":286,"context_line":"  The ``Issuer`` in the certificate along with the defined ``protocol``"},{"line_number":287,"context_line":"  in `keystone.conf` will uniquely identify the mapping. The ``Subject``"}],"source_content_type":"text/x-rst","patch_set":55,"id":"da20952f_44d0dd53","line":284,"in_reply_to":"da20952f_2504d913","updated":"2015-08-27 03:51:32.000000000","message":"done","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d338bea3e6ae19a1c958d7d99347292a831b7bb3","unresolved":false,"context_lines":[{"line_number":20,"context_line":"-----------"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"* `X.509 Tokenless Authorization`: Provides a means to authorize client"},{"line_number":23,"context_line":"    operations within Keystone by using an X.509 SSL client certificate"},{"line_number":24,"context_line":"    without having to issue a token. For details, please refer to the specs"},{"line_number":25,"context_line":"    `Tokenless Authorization with X.509 Client SSL Certificate`_"},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":56,"id":"da20952f_954f0092","line":23,"updated":"2015-08-27 13:34:49.000000000","message":"Lines these lines up with 22. So remove 2 of the leading spaces.","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"019cbb1766bd174d043356f6de9920ffb207767e","unresolved":false,"context_lines":[{"line_number":20,"context_line":"-----------"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"* `X.509 Tokenless Authorization`: Provides a means to authorize client"},{"line_number":23,"context_line":"    operations within Keystone by using an X.509 SSL client certificate"},{"line_number":24,"context_line":"    without having to issue a token. For details, please refer to the specs"},{"line_number":25,"context_line":"    `Tokenless Authorization with X.509 Client SSL Certificate`_"},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":56,"id":"da20952f_5b0973dc","line":23,"in_reply_to":"da20952f_954f0092","updated":"2015-08-27 18:19:47.000000000","message":"done","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d338bea3e6ae19a1c958d7d99347292a831b7bb3","unresolved":false,"context_lines":[{"line_number":42,"context_line":"--------------------"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"To enable X.509 tokenless authorization, SSL has to be enabled and configured"},{"line_number":45,"context_line":"in the Apache virtual host file. Client authentication (``SSLVerifyClient``)"},{"line_number":46,"context_line":"should be set as ``optional`` to allow other token authentication methods."},{"line_number":47,"context_line":"And attribute ``SSLOptions`` needs to set as ``+StdEnvVars`` to allow"},{"line_number":48,"context_line":"certificate attributes to be passed. The following is the sample virtual host"}],"source_content_type":"text/x-rst","patch_set":56,"id":"da20952f_18948589","line":45,"updated":"2015-08-27 13:34:49.000000000","message":"maybe lose the parens here. it looks odd in the rendered doc","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"019cbb1766bd174d043356f6de9920ffb207767e","unresolved":false,"context_lines":[{"line_number":42,"context_line":"--------------------"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"To enable X.509 tokenless authorization, SSL has to be enabled and configured"},{"line_number":45,"context_line":"in the Apache virtual host file. Client authentication (``SSLVerifyClient``)"},{"line_number":46,"context_line":"should be set as ``optional`` to allow other token authentication methods."},{"line_number":47,"context_line":"And attribute ``SSLOptions`` needs to set as ``+StdEnvVars`` to allow"},{"line_number":48,"context_line":"certificate attributes to be passed. The following is the sample virtual host"}],"source_content_type":"text/x-rst","patch_set":56,"id":"da20952f_1bebfbb1","line":45,"in_reply_to":"da20952f_18948589","updated":"2015-08-27 18:19:47.000000000","message":"ok, let me try to change the format a little bit","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d338bea3e6ae19a1c958d7d99347292a831b7bb3","unresolved":false,"context_lines":[{"line_number":44,"context_line":"To enable X.509 tokenless authorization, SSL has to be enabled and configured"},{"line_number":45,"context_line":"in the Apache virtual host file. Client authentication (``SSLVerifyClient``)"},{"line_number":46,"context_line":"should be set as ``optional`` to allow other token authentication methods."},{"line_number":47,"context_line":"And attribute ``SSLOptions`` needs to set as ``+StdEnvVars`` to allow"},{"line_number":48,"context_line":"certificate attributes to be passed. The following is the sample virtual host"},{"line_number":49,"context_line":"file used for the testing."},{"line_number":50,"context_line":""}],"source_content_type":"text/x-rst","patch_set":56,"id":"da20952f_386e29ca","line":47,"updated":"2015-08-27 13:34:49.000000000","message":"Make these two sentences joined by an \u0027and\u0027 instead of a sentence staring with \u0027and\u0027.","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"019cbb1766bd174d043356f6de9920ffb207767e","unresolved":false,"context_lines":[{"line_number":44,"context_line":"To enable X.509 tokenless authorization, SSL has to be enabled and configured"},{"line_number":45,"context_line":"in the Apache virtual host file. Client authentication (``SSLVerifyClient``)"},{"line_number":46,"context_line":"should be set as ``optional`` to allow other token authentication methods."},{"line_number":47,"context_line":"And attribute ``SSLOptions`` needs to set as ``+StdEnvVars`` to allow"},{"line_number":48,"context_line":"certificate attributes to be passed. The following is the sample virtual host"},{"line_number":49,"context_line":"file used for the testing."},{"line_number":50,"context_line":""}],"source_content_type":"text/x-rst","patch_set":56,"id":"da20952f_db9fc34e","line":47,"in_reply_to":"da20952f_386e29ca","updated":"2015-08-27 18:19:47.000000000","message":"done","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d338bea3e6ae19a1c958d7d99347292a831b7bb3","unresolved":false,"context_lines":[{"line_number":58,"context_line":"        SSLEngine on"},{"line_number":59,"context_line":"        SSLCertificateFile    /etc/apache2/ssl/apache.cer"},{"line_number":60,"context_line":"        SSLCertificateKeyFile /etc/apache2/ssl/apache.key"},{"line_number":61,"context_line":"        SSLCACertificatePath /home/dhu/dev/curl/capath"},{"line_number":62,"context_line":"        SSLOptions +StdEnvVars"},{"line_number":63,"context_line":"        SSLVerifyClient optional"},{"line_number":64,"context_line":"    \u003c/VirtualHost\u003e"}],"source_content_type":"text/x-rst","patch_set":56,"id":"da20952f_789b41ca","line":61,"updated":"2015-08-27 13:34:49.000000000","message":"hi dhu! is there a more standard path we can use?","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"019cbb1766bd174d043356f6de9920ffb207767e","unresolved":false,"context_lines":[{"line_number":58,"context_line":"        SSLEngine on"},{"line_number":59,"context_line":"        SSLCertificateFile    /etc/apache2/ssl/apache.cer"},{"line_number":60,"context_line":"        SSLCertificateKeyFile /etc/apache2/ssl/apache.key"},{"line_number":61,"context_line":"        SSLCACertificatePath /home/dhu/dev/curl/capath"},{"line_number":62,"context_line":"        SSLOptions +StdEnvVars"},{"line_number":63,"context_line":"        SSLVerifyClient optional"},{"line_number":64,"context_line":"    \u003c/VirtualHost\u003e"}],"source_content_type":"text/x-rst","patch_set":56,"id":"da20952f_7bf3179f","line":61,"in_reply_to":"da20952f_789b41ca","updated":"2015-08-27 18:19:47.000000000","message":"yeah, will fix it ;-)","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d338bea3e6ae19a1c958d7d99347292a831b7bb3","unresolved":false,"context_lines":[{"line_number":69,"context_line":""},{"line_number":70,"context_line":"The following options can be defined in `keystone.conf`:"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"* ``trusted_issuer`` - The list of trusted issuers to further filter the"},{"line_number":73,"context_line":"  certificates that are allowed to participate in the X.509 tokenless"},{"line_number":74,"context_line":"  authorization. If the option is absent then no certificates will be"},{"line_number":75,"context_line":"  allowed. The naming format for the attributes of a Distinguished Name(DN)"}],"source_content_type":"text/x-rst","patch_set":56,"id":"da20952f_58b0bdf4","line":72,"updated":"2015-08-27 13:34:49.000000000","message":"In the config file this really isn\u0027t a list. The operator just specifies it multiple times. (Although I just checked how we document other multi-opts and we call then lists)","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"019cbb1766bd174d043356f6de9920ffb207767e","unresolved":false,"context_lines":[{"line_number":69,"context_line":""},{"line_number":70,"context_line":"The following options can be defined in `keystone.conf`:"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"* ``trusted_issuer`` - The list of trusted issuers to further filter the"},{"line_number":73,"context_line":"  certificates that are allowed to participate in the X.509 tokenless"},{"line_number":74,"context_line":"  authorization. If the option is absent then no certificates will be"},{"line_number":75,"context_line":"  allowed. The naming format for the attributes of a Distinguished Name(DN)"}],"source_content_type":"text/x-rst","patch_set":56,"id":"da20952f_562aaa7f","line":72,"in_reply_to":"da20952f_58b0bdf4","updated":"2015-08-27 18:19:47.000000000","message":"true, in writing I think we just call it a list, another alternative is to call it \u0027multi-opts\u0027 list  ... any wording suggestion here?","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d338bea3e6ae19a1c958d7d99347292a831b7bb3","unresolved":false,"context_lines":[{"line_number":73,"context_line":"  certificates that are allowed to participate in the X.509 tokenless"},{"line_number":74,"context_line":"  authorization. If the option is absent then no certificates will be"},{"line_number":75,"context_line":"  allowed. The naming format for the attributes of a Distinguished Name(DN)"},{"line_number":76,"context_line":"  must be separated by a comma and contain no spaces. This configuration"},{"line_number":77,"context_line":"  option may be repeated for multiple values. For example::"},{"line_number":78,"context_line":"  trusted_issuer\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack"},{"line_number":79,"context_line":"  trusted_issuer\u003dCN\u003dmary,OU\u003deng,O\u003dabc"}],"source_content_type":"text/x-rst","patch_set":56,"id":"da20952f_7b26dbbb","line":76,"updated":"2015-08-27 13:34:49.000000000","message":"What about your example below where L\u003dSan Jose? Do they just remove the spaces?","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"019cbb1766bd174d043356f6de9920ffb207767e","unresolved":false,"context_lines":[{"line_number":73,"context_line":"  certificates that are allowed to participate in the X.509 tokenless"},{"line_number":74,"context_line":"  authorization. If the option is absent then no certificates will be"},{"line_number":75,"context_line":"  allowed. The naming format for the attributes of a Distinguished Name(DN)"},{"line_number":76,"context_line":"  must be separated by a comma and contain no spaces. This configuration"},{"line_number":77,"context_line":"  option may be repeated for multiple values. For example::"},{"line_number":78,"context_line":"  trusted_issuer\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack"},{"line_number":79,"context_line":"  trusted_issuer\u003dCN\u003dmary,OU\u003deng,O\u003dabc"}],"source_content_type":"text/x-rst","patch_set":56,"id":"da20952f_7691ee98","line":76,"in_reply_to":"da20952f_7b26dbbb","updated":"2015-08-27 18:19:47.000000000","message":"spaces in the value of the DN attributes are allowed, I will add that to clarify.","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d338bea3e6ae19a1c958d7d99347292a831b7bb3","unresolved":false,"context_lines":[{"line_number":75,"context_line":"  allowed. The naming format for the attributes of a Distinguished Name(DN)"},{"line_number":76,"context_line":"  must be separated by a comma and contain no spaces. This configuration"},{"line_number":77,"context_line":"  option may be repeated for multiple values. For example::"},{"line_number":78,"context_line":"  trusted_issuer\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack"},{"line_number":79,"context_line":"  trusted_issuer\u003dCN\u003dmary,OU\u003deng,O\u003dabc"},{"line_number":80,"context_line":"* ``protocol`` - The protocol name for the X.509 tokenless authorization"},{"line_number":81,"context_line":"  along with the Identity Provider(IdP) ID to look up its corresponding"}],"source_content_type":"text/x-rst","patch_set":56,"id":"da20952f_3899496f","line":78,"updated":"2015-08-27 13:34:49.000000000","message":"This doesn\u0027t render correctly. It probably needs to be a code-block or you could point to the example you give below on line 92.\n\nhttp://docs-draft.openstack.org/70/156870/56/check/gate-keystone-docs/3992019//doc/build/html/configure_tokenless_x509.html","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"019cbb1766bd174d043356f6de9920ffb207767e","unresolved":false,"context_lines":[{"line_number":75,"context_line":"  allowed. The naming format for the attributes of a Distinguished Name(DN)"},{"line_number":76,"context_line":"  must be separated by a comma and contain no spaces. This configuration"},{"line_number":77,"context_line":"  option may be repeated for multiple values. For example::"},{"line_number":78,"context_line":"  trusted_issuer\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack"},{"line_number":79,"context_line":"  trusted_issuer\u003dCN\u003dmary,OU\u003deng,O\u003dabc"},{"line_number":80,"context_line":"* ``protocol`` - The protocol name for the X.509 tokenless authorization"},{"line_number":81,"context_line":"  along with the Identity Provider(IdP) ID to look up its corresponding"}],"source_content_type":"text/x-rst","patch_set":56,"id":"da20952f_5662aaae","line":78,"in_reply_to":"da20952f_3899496f","updated":"2015-08-27 18:19:47.000000000","message":"yeah, that\u0027s right. I could just use the code block below as the example.","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d338bea3e6ae19a1c958d7d99347292a831b7bb3","unresolved":false,"context_lines":[{"line_number":137,"context_line":"    idp_id \u003d hashed_idp.hexdigest()"},{"line_number":138,"context_line":"    print(idp_id)"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"The output of the above python code will be the IdP ID. And the following"},{"line_number":141,"context_line":"sample curl command should be sent to keystone to create an IdP with the"},{"line_number":142,"context_line":"newly generated IdP ID."},{"line_number":143,"context_line":""}],"source_content_type":"text/x-rst","patch_set":56,"id":"da20952f_b820f9f8","line":140,"updated":"2015-08-27 13:34:49.000000000","message":"Python\n\n... and the same thing with and as above.","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"019cbb1766bd174d043356f6de9920ffb207767e","unresolved":false,"context_lines":[{"line_number":137,"context_line":"    idp_id \u003d hashed_idp.hexdigest()"},{"line_number":138,"context_line":"    print(idp_id)"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"The output of the above python code will be the IdP ID. And the following"},{"line_number":141,"context_line":"sample curl command should be sent to keystone to create an IdP with the"},{"line_number":142,"context_line":"newly generated IdP ID."},{"line_number":143,"context_line":""}],"source_content_type":"text/x-rst","patch_set":56,"id":"da20952f_d66eba95","line":140,"in_reply_to":"da20952f_b820f9f8","updated":"2015-08-27 18:19:47.000000000","message":"done","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d338bea3e6ae19a1c958d7d99347292a831b7bb3","unresolved":false,"context_lines":[{"line_number":279,"context_line":"-----------------"},{"line_number":280,"context_line":""},{"line_number":281,"context_line":"The scope information will be passed from the headers with the following"},{"line_number":282,"context_line":"keywords to:"},{"line_number":283,"context_line":""},{"line_number":284,"context_line":"* ``X-Project-Id`` - If specified, its the project scope."},{"line_number":285,"context_line":"* ``X-Project-Name`` - If specified, its the project scope."}],"source_content_type":"text/x-rst","patch_set":56,"id":"da20952f_989ad513","line":282,"updated":"2015-08-27 13:34:49.000000000","message":"This sentence feels off. keywords?","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"019cbb1766bd174d043356f6de9920ffb207767e","unresolved":false,"context_lines":[{"line_number":279,"context_line":"-----------------"},{"line_number":280,"context_line":""},{"line_number":281,"context_line":"The scope information will be passed from the headers with the following"},{"line_number":282,"context_line":"keywords to:"},{"line_number":283,"context_line":""},{"line_number":284,"context_line":"* ``X-Project-Id`` - If specified, its the project scope."},{"line_number":285,"context_line":"* ``X-Project-Name`` - If specified, its the project scope."}],"source_content_type":"text/x-rst","patch_set":56,"id":"da20952f_b6a466a6","line":282,"in_reply_to":"da20952f_989ad513","updated":"2015-08-27 18:19:47.000000000","message":"yeah, will fix it.","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"d075a9f2d6a8687e4041eac4d67a79a8c35fc0e7","unresolved":false,"context_lines":[{"line_number":299,"context_line":""},{"line_number":300,"context_line":".. code-block:: bash"},{"line_number":301,"context_line":""},{"line_number":302,"context_line":"    curl -v -k -s -X GET --cert /\u003cPATH\u003e/x509client.crt \\"},{"line_number":303,"context_line":"         --key /\u003cPATH\u003e/x509client.key \\"},{"line_number":304,"context_line":"         --cacert /\u003cPATH\u003e/ca.crt \\"},{"line_number":305,"context_line":"         -H \"X-Project-Name: \u003cPROJECT-NAME\u003e\" \\"}],"source_content_type":"text/x-rst","patch_set":58,"id":"da20952f_4f17bf44","line":302,"updated":"2015-09-01 10:09:07.000000000","message":"is it really GET?","commit_id":"3c01f8762855e47f34823b76f5fd4a8780704718"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"050cbc134e73e5936cdeccb4b2539246dff687cc","unresolved":false,"context_lines":[{"line_number":299,"context_line":""},{"line_number":300,"context_line":".. code-block:: bash"},{"line_number":301,"context_line":""},{"line_number":302,"context_line":"    curl -v -k -s -X GET --cert /\u003cPATH\u003e/x509client.crt \\"},{"line_number":303,"context_line":"         --key /\u003cPATH\u003e/x509client.key \\"},{"line_number":304,"context_line":"         --cacert /\u003cPATH\u003e/ca.crt \\"},{"line_number":305,"context_line":"         -H \"X-Project-Name: \u003cPROJECT-NAME\u003e\" \\"}],"source_content_type":"text/x-rst","patch_set":58,"id":"da20952f_3f5db4ec","line":302,"in_reply_to":"da20952f_4f17bf44","updated":"2015-09-01 23:56:19.000000000","message":"Yes. Token validate is GET.","commit_id":"3c01f8762855e47f34823b76f5fd4a8780704718"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"b73ef343145505abddc850b642106be5b2b6b7cb","unresolved":false,"context_lines":[{"line_number":299,"context_line":""},{"line_number":300,"context_line":".. code-block:: bash"},{"line_number":301,"context_line":""},{"line_number":302,"context_line":"    curl -v -k -s -X GET --cert /\u003cPATH\u003e/x509client.crt \\"},{"line_number":303,"context_line":"         --key /\u003cPATH\u003e/x509client.key \\"},{"line_number":304,"context_line":"         --cacert /\u003cPATH\u003e/ca.crt \\"},{"line_number":305,"context_line":"         -H \"X-Project-Name: \u003cPROJECT-NAME\u003e\" \\"}],"source_content_type":"text/x-rst","patch_set":58,"id":"da20952f_16bb0d77","line":302,"in_reply_to":"da20952f_4f17bf44","updated":"2015-09-02 00:09:20.000000000","message":"yes, it\u0027s really GET ;-)\nThis is the main use case to do token validation. And it\u0027s really similar to what we do today for token validation with X-Auth-Token, like -\n\ncurl -v -k -s -X GET -H \"X-Auth-Token: \u003cauth token\u003e\" -H \"X-Subject-Token: subject token\" https://10.0.2.15/v3/auth/tokens | python -mjson.tool","commit_id":"3c01f8762855e47f34823b76f5fd4a8780704718"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"cb9f8a346d8c7d54f673ebd94a6fb5930be69415","unresolved":false,"context_lines":[{"line_number":122,"context_line":"    S\u003dCalifornia"},{"line_number":123,"context_line":"    C\u003dUS"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"The issuer DN should be constructed as a string that contains no spaces"},{"line_number":126,"context_line":"and have the right order seperated by commas like the example below."},{"line_number":127,"context_line":"Please be aware that ``emailAddress`` and ``ST`` should be used instead"},{"line_number":128,"context_line":"of ``E`` and ``S`` that are shown in the above example. The following is"}],"source_content_type":"text/x-rst","patch_set":59,"id":"da20952f_56d38a5f","line":125,"updated":"2015-09-02 17:23:29.000000000","message":"Afaik DNs can have spaces? Please confirm this is not against rfc","commit_id":"882a9d163726df4357783d7d3a729c814796a46c"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"02b358c124b022b82686996ae83e997a8d1ae288","unresolved":false,"context_lines":[{"line_number":122,"context_line":"    S\u003dCalifornia"},{"line_number":123,"context_line":"    C\u003dUS"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"The issuer DN should be constructed as a string that contains no spaces"},{"line_number":126,"context_line":"and have the right order seperated by commas like the example below."},{"line_number":127,"context_line":"Please be aware that ``emailAddress`` and ``ST`` should be used instead"},{"line_number":128,"context_line":"of ``E`` and ``S`` that are shown in the above example. The following is"}],"source_content_type":"text/x-rst","patch_set":59,"id":"da20952f_9644c2b7","line":125,"in_reply_to":"da20952f_56d38a5f","updated":"2015-09-02 17:39:57.000000000","message":"The DN being passed by mod_ssl to the request env contains no spaces. so we just need to match it when creating the IdP Id and I believe this is against rfc.","commit_id":"882a9d163726df4357783d7d3a729c814796a46c"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"375698f405d8e01363afb3ded360a4d6210a26ae","unresolved":false,"context_lines":[{"line_number":135,"context_line":"        O\u003dopenstack,L\u003dSunnyvale,ST\u003dCalifornia,C\u003dUS\u0027"},{"line_number":136,"context_line":"    hashed_idp \u003d hashlib.sha256(issuer_dn)"},{"line_number":137,"context_line":"    idp_id \u003d hashed_idp.hexdigest()"},{"line_number":138,"context_line":"    print(idp_id)"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"The output of the above Python code will be the IdP ID and the following"},{"line_number":141,"context_line":"sample curl command should be sent to keystone to create an IdP with the"}],"source_content_type":"text/x-rst","patch_set":60,"id":"da20952f_e06d2f9a","line":138,"updated":"2015-09-02 18:52:40.000000000","message":"not sure if we even needed the print statement here.","commit_id":"70a2e91f798dc423705d6a10f3be1996a7cc31de"}],"etc/keystone.conf.sample":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"da86d52c_2a386ded","updated":"2015-02-18 04:09:12.000000000","message":"undo these changes, we can sync the sample_config at another time","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"36c2a5611b345c54d73ba332287bf73a8b46f031","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"ba7be1f8_fe20459d","in_reply_to":"ba7be1f8_0fc5065b","updated":"2015-02-20 18:08:39.000000000","message":"got it. It should be after merged to avoid rebase.","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"d6df9b99a8cff3b2565ed123e931ce580b9e3071","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"ba7be1f8_0fc5065b","in_reply_to":"da86d52c_2a386ded","updated":"2015-02-20 02:48:04.000000000","message":"Steve, this sample file is auto generated by \u0027tox -esample_config -r\u0027 as I have new config option in config.py. So if I undo these changes, when would you think this should be synced?","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"}],"keystone/auth/controllers.py":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"a2cab849c5e8441c44c399393084b3484b548c58","unresolved":false,"context_lines":[{"line_number":275,"context_line":"    def _validate_and_normalize_auth_data(self, scope_only\u003dFalse):"},{"line_number":276,"context_line":"        \"\"\"Make sure \"auth\" is valid."},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"        :param scope_only: If it is true, auth methods will not be"},{"line_number":279,"context_line":"            validated but only the scope data."},{"line_number":280,"context_line":"        \"\"\""},{"line_number":281,"context_line":"        # make sure \"auth\" exist"}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_eddb677a","line":278,"updated":"2015-07-15 19:57:47.000000000","message":"True","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"8ada87ee5b062ac22c3cd494fd285e3982f06c4e","unresolved":false,"context_lines":[{"line_number":275,"context_line":"    def _validate_and_normalize_auth_data(self, scope_only\u003dFalse):"},{"line_number":276,"context_line":"        \"\"\"Make sure \"auth\" is valid."},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"        :param scope_only: If it is true, auth methods will not be"},{"line_number":279,"context_line":"            validated but only the scope data."},{"line_number":280,"context_line":"        \"\"\""},{"line_number":281,"context_line":"        # make sure \"auth\" exist"}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_13826ac8","line":278,"in_reply_to":"9a41bdd9_eddb677a","updated":"2015-07-16 02:50:56.000000000","message":"Done","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"99a8e51e8bba3291f7b20118fe500016df0ab8ac","unresolved":false,"context_lines":[{"line_number":275,"context_line":"    def _validate_and_normalize_auth_data(self, scope_only\u003dFalse):"},{"line_number":276,"context_line":"        \"\"\"Make sure \"auth\" is valid."},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"        :param scope_only: If it is True, auth methods will not be"},{"line_number":279,"context_line":"            validated but only the scope data."},{"line_number":280,"context_line":"        \"\"\""},{"line_number":281,"context_line":"        # make sure \"auth\" exist"}],"source_content_type":"text/x-python","patch_set":47,"id":"3a50d1a3_8c9e08b7","line":278,"updated":"2015-07-30 19:16:53.000000000","message":"add the \"boolean\" parameter type too in the docs","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"288bb4dade83c0212c1f9f86638d0843b09cae40","unresolved":false,"context_lines":[{"line_number":275,"context_line":"    def _validate_and_normalize_auth_data(self, scope_only\u003dFalse):"},{"line_number":276,"context_line":"        \"\"\"Make sure \"auth\" is valid."},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"        :param scope_only: If it is True, auth methods will not be"},{"line_number":279,"context_line":"            validated but only the scope data."},{"line_number":280,"context_line":"        \"\"\""},{"line_number":281,"context_line":"        # make sure \"auth\" exist"}],"source_content_type":"text/x-python","patch_set":47,"id":"3a50d1a3_f8d5cae4","line":278,"in_reply_to":"3a50d1a3_8c9e08b7","updated":"2015-07-31 21:31:31.000000000","message":"done","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"afa73e0f8b7a198c1a22f345d5005af58bbf54c3","unresolved":false,"context_lines":[{"line_number":285,"context_line":"                                            target\u003d\u0027request body\u0027)"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"        if not scope_only:"},{"line_number":288,"context_line":"            self._validate_auth_methods()"},{"line_number":289,"context_line":"        self._validate_and_normalize_scope_data()"},{"line_number":290,"context_line":""},{"line_number":291,"context_line":"    def get_method_names(self):"}],"source_content_type":"text/x-python","patch_set":48,"id":"1a4dcd0f_38f9b94e","line":288,"updated":"2015-08-12 04:26:21.000000000","message":"why are we skipping this? explain why tokenless auth needs this change, preferably in the form of comments in the code","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"03e85143ccdc1c97ee94d14ac87aefcd7528ddf3","unresolved":false,"context_lines":[{"line_number":285,"context_line":"                                            target\u003d\u0027request body\u0027)"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"        if not scope_only:"},{"line_number":288,"context_line":"            self._validate_auth_methods()"},{"line_number":289,"context_line":"        self._validate_and_normalize_scope_data()"},{"line_number":290,"context_line":""},{"line_number":291,"context_line":"    def get_method_names(self):"}],"source_content_type":"text/x-python","patch_set":48,"id":"1a4dcd0f_de288fe4","line":288,"in_reply_to":"1a4dcd0f_38f9b94e","updated":"2015-08-12 22:48:20.000000000","message":"done in the comments","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"960cb80720283eef0de77234e758267eb90a2d3d","unresolved":false,"context_lines":[{"line_number":129,"context_line":"    \"\"\"Encapsulation of \"auth\" request.\"\"\""},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"    @staticmethod"},{"line_number":132,"context_line":"    def create(context, auth\u003dNone, scope_only\u003dFalse):"},{"line_number":133,"context_line":"        auth_info \u003d AuthInfo(context, auth\u003dauth)"},{"line_number":134,"context_line":"        auth_info._validate_and_normalize_auth_data(scope_only)"},{"line_number":135,"context_line":"        return auth_info"}],"source_content_type":"text/x-python","patch_set":50,"id":"fa1b9901_bbb72839","line":132,"updated":"2015-08-20 02:12:44.000000000","message":"this is kinda weird, can we just pass in a flag inside the auth instead to determine that auth_method validation is not needed? (i.e. method)","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5c35fe32e246aaf52a8f5de28d61a87faea3a722","unresolved":false,"context_lines":[{"line_number":129,"context_line":"    \"\"\"Encapsulation of \"auth\" request.\"\"\""},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"    @staticmethod"},{"line_number":132,"context_line":"    def create(context, auth\u003dNone, scope_only\u003dFalse):"},{"line_number":133,"context_line":"        auth_info \u003d AuthInfo(context, auth\u003dauth)"},{"line_number":134,"context_line":"        auth_info._validate_and_normalize_auth_data(scope_only)"},{"line_number":135,"context_line":"        return auth_info"}],"source_content_type":"text/x-python","patch_set":50,"id":"fa1b9901_fa38f3d4","line":132,"in_reply_to":"fa1b9901_bbb72839","updated":"2015-08-21 01:19:55.000000000","message":"auth is the data structure stores all the auth and scope information. passing scope_only as the argument is kind of the instruction/condition that the method will follow. So keeping is as an argument seems to make more sense to me.","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"c07aa71e62729635f59c653e13b216cfbd5587d5","unresolved":false,"context_lines":[{"line_number":289,"context_line":"        # information. Therefore, validating the auth methods here is"},{"line_number":290,"context_line":"        # insignificant and we can skip it when scope_only is set to"},{"line_number":291,"context_line":"        # true."},{"line_number":292,"context_line":"        if not scope_only:"},{"line_number":293,"context_line":"            self._validate_auth_methods()"},{"line_number":294,"context_line":"        self._validate_and_normalize_scope_data()"},{"line_number":295,"context_line":""}],"source_content_type":"text/x-python","patch_set":51,"id":"fa1b9901_191a356f","line":292,"updated":"2015-08-24 08:24:51.000000000","message":"maybe it\u0027d be easier to read :\n\nif scope_only is False:","commit_id":"572a18af0e8520b2fa284bc2f97410be1be96e7e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"a3198243d376815899b6d88deb82b97271a87cbe","unresolved":false,"context_lines":[{"line_number":289,"context_line":"        # information. Therefore, validating the auth methods here is"},{"line_number":290,"context_line":"        # insignificant and we can skip it when scope_only is set to"},{"line_number":291,"context_line":"        # true."},{"line_number":292,"context_line":"        if not scope_only:"},{"line_number":293,"context_line":"            self._validate_auth_methods()"},{"line_number":294,"context_line":"        self._validate_and_normalize_scope_data()"},{"line_number":295,"context_line":""}],"source_content_type":"text/x-python","patch_set":51,"id":"fa1b9901_f0a09aa7","line":292,"in_reply_to":"fa1b9901_191a356f","updated":"2015-08-24 17:29:33.000000000","message":"done.","commit_id":"572a18af0e8520b2fa284bc2f97410be1be96e7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18e1f6d929399c37afba2d62f138238541c71973","unresolved":false,"context_lines":[{"line_number":276,"context_line":"        \"\"\"Make sure \"auth\" is valid."},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"        :param scope_only: If it is True, auth methods will not be"},{"line_number":279,"context_line":"            validated but only the scope data."},{"line_number":280,"context_line":"        :type scope_only: boolean"},{"line_number":281,"context_line":"        \"\"\""},{"line_number":282,"context_line":"        # make sure \"auth\" exist"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_853a85cc","line":279,"updated":"2015-08-26 18:34:25.000000000","message":"nit: indent this line to be under the \u0027If\u0027 above; \n\n    If it is True.... \n    validated but only the scope data.","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5a38c16026ca6a7252db7a0c48d38dd29ef7e852","unresolved":false,"context_lines":[{"line_number":276,"context_line":"        \"\"\"Make sure \"auth\" is valid."},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"        :param scope_only: If it is True, auth methods will not be"},{"line_number":279,"context_line":"            validated but only the scope data."},{"line_number":280,"context_line":"        :type scope_only: boolean"},{"line_number":281,"context_line":"        \"\"\""},{"line_number":282,"context_line":"        # make sure \"auth\" exist"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_ad968792","line":279,"in_reply_to":"da20952f_853a85cc","updated":"2015-08-27 03:51:32.000000000","message":"Done","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"}],"keystone/auth/plugins/mapped.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":54,"context_line":"        ``OS-FEDERATION:protocol``"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"        \"\"\""},{"line_number":57,"context_line":"        "},{"line_number":58,"context_line":"        if \u0027id\u0027 in auth_payload:"},{"line_number":59,"context_line":"            token_ref \u003d self._get_token_ref(auth_payload)"},{"line_number":60,"context_line":"            handle_scoped_token(context, auth_payload, auth_context, token_ref,"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_8a5b1953","line":57,"updated":"2015-02-18 04:09:12.000000000","message":"undo this whitespace change?","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"}],"keystone/auth/plugins/oauth1.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":34,"context_line":""},{"line_number":35,"context_line":"    def authenticate(self, context, auth_info, auth_context):"},{"line_number":36,"context_line":"        \"\"\"Turn a signed request with an access key into a keystone token.\"\"\""},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"        if not self.oauth_api:"},{"line_number":39,"context_line":"            raise exception.Unauthorized(_(\u0027%s not supported\u0027) % self.method)"},{"line_number":40,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_ca28b199","side":"PARENT","line":37,"updated":"2015-02-18 04:09:12.000000000","message":"another unrelated white space change, please revert","commit_id":"687e4d2c81d348bcb9a487ee272983f75cb5141d"}],"keystone/common/authorization.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":21,"context_line":"from keystone import exception"},{"line_number":22,"context_line":"from keystone.i18n import _, _LW"},{"line_number":23,"context_line":"from keystone.models import token_model"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"AUTH_CONTEXT_ENV \u003d \u0027KEYSTONE_AUTH_CONTEXT\u0027"},{"line_number":27,"context_line":"\"\"\"Environment variable used to convey the Keystone auth context."}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_6a0c2543","side":"PARENT","line":24,"updated":"2015-02-18 04:09:12.000000000","message":"unrelated white space change","commit_id":"687e4d2c81d348bcb9a487ee272983f75cb5141d"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":22,"context_line":"import sys"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"from oslo_log import log"},{"line_number":25,"context_line":"from oslo.serialization import jsonutils"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"from keystone import exception"},{"line_number":28,"context_line":"from keystone.auth.controllers import AuthInfo"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_0a1e4970","line":25,"updated":"2015-02-18 04:09:12.000000000","message":"use:\n\n  from oslo_serialization import jsonutils","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":25,"context_line":"from oslo.serialization import jsonutils"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"from keystone import exception"},{"line_number":28,"context_line":"from keystone.auth.controllers import AuthInfo"},{"line_number":29,"context_line":"from keystone.common import dependency"},{"line_number":30,"context_line":"from keystone.contrib.federation import utils"},{"line_number":31,"context_line":"from keystone.i18n import _, _LW"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_aa029d09","line":28,"updated":"2015-02-18 04:09:12.000000000","message":"do not import classes, import the module","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":98,"context_line":"@dependency.requires(\u0027federation_api\u0027, \u0027identity_api\u0027, \u0027assignment_api\u0027)"},{"line_number":99,"context_line":"class TokenlessAuthHelper(object):"},{"line_number":100,"context_line":"    _instance \u003d None"},{"line_number":101,"context_line":"    "},{"line_number":102,"context_line":"    def __new__(cls, *args, **kwargs):"},{"line_number":103,"context_line":"        \"\"\"Make the class as a singleton class."},{"line_number":104,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_edff4fff","line":101,"updated":"2015-02-18 04:09:12.000000000","message":"run `tox - e pep8` to catch these errors before submitting","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":100,"context_line":"    _instance \u003d None"},{"line_number":101,"context_line":"    "},{"line_number":102,"context_line":"    def __new__(cls, *args, **kwargs):"},{"line_number":103,"context_line":"        \"\"\"Make the class as a singleton class."},{"line_number":104,"context_line":"        \"\"\""},{"line_number":105,"context_line":"        if not cls._instance:"},{"line_number":106,"context_line":"            cls._instance \u003d super(TokenlessAuthHelper, cls).__new__("}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_cd89ab70","line":103,"updated":"2015-02-18 04:09:12.000000000","message":"why do we want this to be a singleton?","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":108,"context_line":"        return cls._instance"},{"line_number":109,"context_line":"    "},{"line_number":110,"context_line":"    "},{"line_number":111,"context_line":"    def __init__(self):"},{"line_number":112,"context_line":"        pass"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"    def _build_scope_info(self, env):"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_8dda5376","line":111,"updated":"2015-02-18 04:09:12.000000000","message":"if this isn\u0027t doing anything, then remove it","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":115,"context_line":"        \"\"\" Build the token request scope based on the headers."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"        :param env: request environment"},{"line_number":118,"context_line":"        :return: scope data"},{"line_number":119,"context_line":"        \"\"\""},{"line_number":120,"context_line":"        project_id \u003d env.get(\u0027HTTP_X_PROJECT_ID\u0027)"},{"line_number":121,"context_line":"        project_name \u003d env.get(\u0027HTTP_X_PROJECT_NAME\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_0d882370","line":118,"updated":"2015-02-18 04:09:12.000000000","message":":rtype: dict","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":133,"context_line":"                if project_domain_id:"},{"line_number":134,"context_line":"                    scope[\u0027project\u0027][\u0027domain\u0027] \u003d {\u0027id\u0027: project_domain_id}"},{"line_number":135,"context_line":"                elif project_domain_name:"},{"line_number":136,"context_line":"                    scope[\u0027project\u0027][\u0027domain\u0027] \u003d {\u0027name\u0027: project_domain_name}"},{"line_number":137,"context_line":"        elif domain_id or domain_name:"},{"line_number":138,"context_line":"            if domain_id:"},{"line_number":139,"context_line":"                scope[\u0027domain\u0027] \u003d {\u0027id\u0027: domain_id}"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_ed058fc2","line":136,"updated":"2015-02-18 04:09:12.000000000","message":"what if neither project_domain_id or project_domain_name are specified.","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":165,"context_line":"            certificate attributes, such as"},{"line_number":166,"context_line":"            SSL_CLIENT_S_DN_CN, SSL_CLIENT_I_DN_O"},{"line_number":167,"context_line":"        :return: A dictionary that contains the keys, such as"},{"line_number":168,"context_line":"            user_id, user_name, domain_id, domain_name"},{"line_number":169,"context_line":"        \"\"\""},{"line_number":170,"context_line":"        idp_id \u003d self._build_idp_id(env)"},{"line_number":171,"context_line":"        LOG.debug(\"The IDP used for looking up the x509 mapping is %s\" % x509_idp)"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_cdb28b48","line":168,"updated":"2015-02-18 04:09:12.000000000","message":":rtype: dict","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":168,"context_line":"            user_id, user_name, domain_id, domain_name"},{"line_number":169,"context_line":"        \"\"\""},{"line_number":170,"context_line":"        idp_id \u003d self._build_idp_id(env)"},{"line_number":171,"context_line":"        LOG.debug(\"The IDP used for looking up the x509 mapping is %s\" % x509_idp)"},{"line_number":172,"context_line":"        "},{"line_number":173,"context_line":"        # NOTE{chioleong}: The protocol \u0027x509\u0027 is hard coded here. "},{"line_number":174,"context_line":"        # It may alternatively be a configurable option."}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_4d0bfb23","line":171,"updated":"2015-02-18 04:09:12.000000000","message":"using single quotes instead of double","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":173,"context_line":"        # NOTE{chioleong}: The protocol \u0027x509\u0027 is hard coded here. "},{"line_number":174,"context_line":"        # It may alternatively be a configurable option."},{"line_number":175,"context_line":"        mapping \u003d self.federation_api.get_mapping_from_idp_and_protocol("},{"line_number":176,"context_line":"            idp_id, \u0027x509\u0027)"},{"line_number":177,"context_line":"        rules \u003d jsonutils.loads(mapping[\u0027rules\u0027])"},{"line_number":178,"context_line":"        LOG.debug(\u0027Tokenless authentication uses the following rules: %s\u0027, rules)"},{"line_number":179,"context_line":"        rule_processor \u003d utils.RuleProcessor(rules)"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_ad47174b","line":176,"updated":"2015-02-18 04:09:12.000000000","message":"we can\u0027t have x509 like that on it\u0027s own, we should either make this a class variable or maybe even consider having it as a config option.","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":186,"context_line":""},{"line_number":187,"context_line":"        if user_id:"},{"line_number":188,"context_line":"            user_ref \u003d self.identity_api.get_user(user_id)"},{"line_number":189,"context_line":"        elif (user_name and (user_domain_name or user_domain_id)):"},{"line_number":190,"context_line":"            if user_domain_name:"},{"line_number":191,"context_line":"                user_domain \u003d self.resource_api.get_domain_by_name(domain_name)"},{"line_number":192,"context_line":"                self.resource_api.assert_domain_enabled(user_domain[\u0027id\u0027], user_domain)"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_0d3d838f","line":189,"updated":"2015-02-18 04:09:12.000000000","message":"unnecessary brackets wrapping everything","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":194,"context_line":"            user_ref \u003d self.identity_api.get_user_by_name(user_name, user_domain_id)"},{"line_number":195,"context_line":"        else:"},{"line_number":196,"context_line":"            msg \u003d _LW(\u0027User auth cannot be built due to missing \u0027"},{"line_number":197,"context_line":"                \u0027provided input: user Id is None or (user_name and domain_id) \u0027"},{"line_number":198,"context_line":"                \u0027is None or (user_name and domain_name) is None\u0027)"},{"line_number":199,"context_line":"            raise exception.ValidationError(msg)"},{"line_number":200,"context_line":"        self.assert_user_is_enabled(user_ref[\u0027id\u0027], user_ref)"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_4d221ba4","line":197,"updated":"2015-02-18 04:09:12.000000000","message":"indent this over a bit, and the line below","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":207,"context_line":"        base64_idp \u003d base64(sha1(env[\u0027SSL_CLIENT_I_DN\u0027]))"},{"line_number":208,"context_line":"        "},{"line_number":209,"context_line":"        :param env: The environment"},{"line_number":210,"context_line":"        :returns: base64_idp like the above example"},{"line_number":211,"context_line":"        \"\"\""},{"line_number":212,"context_line":"        try:"},{"line_number":213,"context_line":"            idp \u003d env.get(\u0027SSL_CLIENT_I_DN\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_cd160b49","line":210,"updated":"2015-02-18 04:09:12.000000000","message":":rtype: str","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":210,"context_line":"        :returns: base64_idp like the above example"},{"line_number":211,"context_line":"        \"\"\""},{"line_number":212,"context_line":"        try:"},{"line_number":213,"context_line":"            idp \u003d env.get(\u0027SSL_CLIENT_I_DN\u0027)"},{"line_number":214,"context_line":"        except KeyError as e:"},{"line_number":215,"context_line":"            six.reraise(exception.ValidationError(e))"},{"line_number":216,"context_line":"        "}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_0dd6634f","line":213,"updated":"2015-02-18 04:09:12.000000000","message":"will this ever change? should this be a config option?","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":212,"context_line":"        try:"},{"line_number":213,"context_line":"            idp \u003d env.get(\u0027SSL_CLIENT_I_DN\u0027)"},{"line_number":214,"context_line":"        except KeyError as e:"},{"line_number":215,"context_line":"            six.reraise(exception.ValidationError(e))"},{"line_number":216,"context_line":"        "},{"line_number":217,"context_line":"        hashed_idp \u003d hashlib.sha256(idp)"},{"line_number":218,"context_line":"        return base64.b64encode(hashed_idp.digest())"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_6dafdfe3","line":215,"updated":"2015-02-18 04:09:12.000000000","message":"provide a meaningful error message here, not just a stack trace. \"Could not determine Identity Provider Id based on SSL_CLIENT_I_DN value %s\"","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"}],"keystone/common/config.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2980c8fc4ec04546375fa362d53b2d238a90cebf","unresolved":false,"context_lines":[{"line_number":782,"context_line":"                   default\u003d\u0027keystone.auth.plugins.external.DefaultDomain\u0027,"},{"line_number":783,"context_line":"                   help\u003d\u0027The external (REMOTE_USER) auth plugin module.\u0027),"},{"line_number":784,"context_line":"        cfg.ListOpt(\u0027trusted_issuers\u0027, default\u003d[],"},{"line_number":785,"context_line":"                    help\u003d\u0027A list of trusted issuers to further filter the \u0027"},{"line_number":786,"context_line":"                    \u0027certificates that are allowed to participate in the \u0027"},{"line_number":787,"context_line":"                    \u0027tokenless authorization. If it is absent, \u0027"},{"line_number":788,"context_line":"                    \u0027no certificates will be allowed in the tokenless \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_d0bb5e0c","line":785,"updated":"2015-02-21 05:04:37.000000000","message":"I\u0027m confused here, are we adding issuers to the list or DNs?\n\n  trusted_issuer\u003d\u0027keystone.openstack.com\u0027\nor \n  trusted_issuer\u003d\u0027CN%3Dfoo%2COU%3Dkeystone%2CO%3Dopenstack\u0027\n\nThe text says issuer but the example says DN","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"fc1c53e4db3bc7ffae4618bc40ffaa0b1fb2621c","unresolved":false,"context_lines":[{"line_number":782,"context_line":"                   default\u003d\u0027keystone.auth.plugins.external.DefaultDomain\u0027,"},{"line_number":783,"context_line":"                   help\u003d\u0027The external (REMOTE_USER) auth plugin module.\u0027),"},{"line_number":784,"context_line":"        cfg.ListOpt(\u0027trusted_issuers\u0027, default\u003d[],"},{"line_number":785,"context_line":"                    help\u003d\u0027A list of trusted issuers to further filter the \u0027"},{"line_number":786,"context_line":"                    \u0027certificates that are allowed to participate in the \u0027"},{"line_number":787,"context_line":"                    \u0027tokenless authorization. If it is absent, \u0027"},{"line_number":788,"context_line":"                    \u0027no certificates will be allowed in the tokenless \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_8ea3624e","line":785,"in_reply_to":"ba7be1f8_d0bb5e0c","updated":"2015-02-23 19:11:13.000000000","message":"The value of the Issuer attribute in a certificate is a DN, like \u0027CN\u003dfoo,OU\u003dkeystone,O\u003dopenstack\u0027, and that\u0027s the Issuer\u0027s DN we are adding in the list.","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2980c8fc4ec04546375fa362d53b2d238a90cebf","unresolved":false,"context_lines":[{"line_number":783,"context_line":"                   help\u003d\u0027The external (REMOTE_USER) auth plugin module.\u0027),"},{"line_number":784,"context_line":"        cfg.ListOpt(\u0027trusted_issuers\u0027, default\u003d[],"},{"line_number":785,"context_line":"                    help\u003d\u0027A list of trusted issuers to further filter the \u0027"},{"line_number":786,"context_line":"                    \u0027certificates that are allowed to participate in the \u0027"},{"line_number":787,"context_line":"                    \u0027tokenless authorization. If it is absent, \u0027"},{"line_number":788,"context_line":"                    \u0027no certificates will be allowed in the tokenless \u0027"},{"line_number":789,"context_line":"                    \u0027authoriztion.\u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_9093a6a2","line":786,"updated":"2015-02-21 05:04:37.000000000","message":"use up at 79 characters per line, and bump the lines over a bit so they align better.\n\n  help\u003d\u0027A list of trusted ...\n       \u0027certifications ...","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"fc1c53e4db3bc7ffae4618bc40ffaa0b1fb2621c","unresolved":false,"context_lines":[{"line_number":783,"context_line":"                   help\u003d\u0027The external (REMOTE_USER) auth plugin module.\u0027),"},{"line_number":784,"context_line":"        cfg.ListOpt(\u0027trusted_issuers\u0027, default\u003d[],"},{"line_number":785,"context_line":"                    help\u003d\u0027A list of trusted issuers to further filter the \u0027"},{"line_number":786,"context_line":"                    \u0027certificates that are allowed to participate in the \u0027"},{"line_number":787,"context_line":"                    \u0027tokenless authorization. If it is absent, \u0027"},{"line_number":788,"context_line":"                    \u0027no certificates will be allowed in the tokenless \u0027"},{"line_number":789,"context_line":"                    \u0027authoriztion.\u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_ce847ab3","line":786,"in_reply_to":"ba7be1f8_9093a6a2","updated":"2015-02-23 19:11:13.000000000","message":"will do.","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6fd31068d72e8e36daf0271964ac2c546cdcd302","unresolved":false,"context_lines":[{"line_number":787,"context_line":"                    \u0027tokenless authorization. If it is absent, \u0027"},{"line_number":788,"context_line":"                    \u0027no certificates will be allowed in the tokenless \u0027"},{"line_number":789,"context_line":"                    \u0027authoriztion.\u0027"},{"line_number":790,"context_line":"                    \u0027The format of each DNs in the list need to use \u0027"},{"line_number":791,"context_line":"                    \u0027URL escaped characters due to limitation of the parser \u0027"},{"line_number":792,"context_line":"                    \u0027for the character comma. For example: \u0027"},{"line_number":793,"context_line":"                    \u0027DN: CN\u003dfoo,OU\u003dkeystone,O\u003dopenstack \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_84fdf03c","line":790,"updated":"2015-02-24 04:43:39.000000000","message":"...of each DN in the...","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2980c8fc4ec04546375fa362d53b2d238a90cebf","unresolved":false,"context_lines":[{"line_number":788,"context_line":"                    \u0027no certificates will be allowed in the tokenless \u0027"},{"line_number":789,"context_line":"                    \u0027authoriztion.\u0027"},{"line_number":790,"context_line":"                    \u0027The format of each DNs in the list need to use \u0027"},{"line_number":791,"context_line":"                    \u0027URL escaped characters due to limitation of the parser \u0027"},{"line_number":792,"context_line":"                    \u0027for the character comma. For example: \u0027"},{"line_number":793,"context_line":"                    \u0027DN: CN\u003dfoo,OU\u003dkeystone,O\u003dopenstack \u0027"},{"line_number":794,"context_line":"                    \u0027URL escaped: CN%3Dfoo%2COU%3Dkeystone%2CO%3Dopenstack\u0027),"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_f0d06255","line":791,"updated":"2015-02-21 05:04:37.000000000","message":"i think saying \u0027due to the limitation of the parser for the character comma.\u0027 is unnecessary to write out in help text, that\u0027s an implementation detail. Just say that the value must be URL escaped, and give an example.","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"fc1c53e4db3bc7ffae4618bc40ffaa0b1fb2621c","unresolved":false,"context_lines":[{"line_number":788,"context_line":"                    \u0027no certificates will be allowed in the tokenless \u0027"},{"line_number":789,"context_line":"                    \u0027authoriztion.\u0027"},{"line_number":790,"context_line":"                    \u0027The format of each DNs in the list need to use \u0027"},{"line_number":791,"context_line":"                    \u0027URL escaped characters due to limitation of the parser \u0027"},{"line_number":792,"context_line":"                    \u0027for the character comma. For example: \u0027"},{"line_number":793,"context_line":"                    \u0027DN: CN\u003dfoo,OU\u003dkeystone,O\u003dopenstack \u0027"},{"line_number":794,"context_line":"                    \u0027URL escaped: CN%3Dfoo%2COU%3Dkeystone%2CO%3Dopenstack\u0027),"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_8eba826c","line":791,"in_reply_to":"ba7be1f8_f0d06255","updated":"2015-02-23 19:11:13.000000000","message":"agree on that.","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2980c8fc4ec04546375fa362d53b2d238a90cebf","unresolved":false,"context_lines":[{"line_number":792,"context_line":"                    \u0027for the character comma. For example: \u0027"},{"line_number":793,"context_line":"                    \u0027DN: CN\u003dfoo,OU\u003dkeystone,O\u003dopenstack \u0027"},{"line_number":794,"context_line":"                    \u0027URL escaped: CN%3Dfoo%2COU%3Dkeystone%2CO%3Dopenstack\u0027),"},{"line_number":795,"context_line":"        cfg.StrOpt(\u0027protocol\u0027,"},{"line_number":796,"context_line":"                   default\u003d\u0027x509\u0027,"},{"line_number":797,"context_line":"                   help\u003d\u0027The protocol name for the tokenless authorization \u0027"},{"line_number":798,"context_line":"                   \u0027along with the Idp name to look up its \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_f0e9421b","line":795,"updated":"2015-02-21 05:04:37.000000000","message":"you *could* make a new section called [tokenless_auth].","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"fc1c53e4db3bc7ffae4618bc40ffaa0b1fb2621c","unresolved":false,"context_lines":[{"line_number":792,"context_line":"                    \u0027for the character comma. For example: \u0027"},{"line_number":793,"context_line":"                    \u0027DN: CN\u003dfoo,OU\u003dkeystone,O\u003dopenstack \u0027"},{"line_number":794,"context_line":"                    \u0027URL escaped: CN%3Dfoo%2COU%3Dkeystone%2CO%3Dopenstack\u0027),"},{"line_number":795,"context_line":"        cfg.StrOpt(\u0027protocol\u0027,"},{"line_number":796,"context_line":"                   default\u003d\u0027x509\u0027,"},{"line_number":797,"context_line":"                   help\u003d\u0027The protocol name for the tokenless authorization \u0027"},{"line_number":798,"context_line":"                   \u0027along with the Idp name to look up its \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_6e6e2e03","line":795,"in_reply_to":"ba7be1f8_f0e9421b","updated":"2015-02-23 19:11:13.000000000","message":"sure, I could do that too.","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2980c8fc4ec04546375fa362d53b2d238a90cebf","unresolved":false,"context_lines":[{"line_number":793,"context_line":"                    \u0027DN: CN\u003dfoo,OU\u003dkeystone,O\u003dopenstack \u0027"},{"line_number":794,"context_line":"                    \u0027URL escaped: CN%3Dfoo%2COU%3Dkeystone%2CO%3Dopenstack\u0027),"},{"line_number":795,"context_line":"        cfg.StrOpt(\u0027protocol\u0027,"},{"line_number":796,"context_line":"                   default\u003d\u0027x509\u0027,"},{"line_number":797,"context_line":"                   help\u003d\u0027The protocol name for the tokenless authorization \u0027"},{"line_number":798,"context_line":"                   \u0027along with the Idp name to look up its \u0027"},{"line_number":799,"context_line":"                   \u0027corresponding mapping.\u0027),"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_d08d1e7d","line":796,"updated":"2015-02-21 05:04:37.000000000","message":"could place default on the same line as the option","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"fc1c53e4db3bc7ffae4618bc40ffaa0b1fb2621c","unresolved":false,"context_lines":[{"line_number":793,"context_line":"                    \u0027DN: CN\u003dfoo,OU\u003dkeystone,O\u003dopenstack \u0027"},{"line_number":794,"context_line":"                    \u0027URL escaped: CN%3Dfoo%2COU%3Dkeystone%2CO%3Dopenstack\u0027),"},{"line_number":795,"context_line":"        cfg.StrOpt(\u0027protocol\u0027,"},{"line_number":796,"context_line":"                   default\u003d\u0027x509\u0027,"},{"line_number":797,"context_line":"                   help\u003d\u0027The protocol name for the tokenless authorization \u0027"},{"line_number":798,"context_line":"                   \u0027along with the Idp name to look up its \u0027"},{"line_number":799,"context_line":"                   \u0027corresponding mapping.\u0027),"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_0e7db2b1","line":796,"in_reply_to":"ba7be1f8_d08d1e7d","updated":"2015-02-23 19:11:13.000000000","message":"will do.","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2980c8fc4ec04546375fa362d53b2d238a90cebf","unresolved":false,"context_lines":[{"line_number":795,"context_line":"        cfg.StrOpt(\u0027protocol\u0027,"},{"line_number":796,"context_line":"                   default\u003d\u0027x509\u0027,"},{"line_number":797,"context_line":"                   help\u003d\u0027The protocol name for the tokenless authorization \u0027"},{"line_number":798,"context_line":"                   \u0027along with the Idp name to look up its \u0027"},{"line_number":799,"context_line":"                   \u0027corresponding mapping.\u0027),"},{"line_number":800,"context_line":"        cfg.StrOpt(\u0027issuer_attri\u0027,"},{"line_number":801,"context_line":"                   default\u003d\u0027SSL_CLIENT_I_DN\u0027,"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_50f92ee8","line":798,"updated":"2015-02-21 05:04:37.000000000","message":"IdP*","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2980c8fc4ec04546375fa362d53b2d238a90cebf","unresolved":false,"context_lines":[{"line_number":797,"context_line":"                   help\u003d\u0027The protocol name for the tokenless authorization \u0027"},{"line_number":798,"context_line":"                   \u0027along with the Idp name to look up its \u0027"},{"line_number":799,"context_line":"                   \u0027corresponding mapping.\u0027),"},{"line_number":800,"context_line":"        cfg.StrOpt(\u0027issuer_attri\u0027,"},{"line_number":801,"context_line":"                   default\u003d\u0027SSL_CLIENT_I_DN\u0027,"},{"line_number":802,"context_line":"                   help\u003d\u0027The issue attribute that is served as a Idp for \u0027"},{"line_number":803,"context_line":"                   \u0027the tokenless authorization along with the protocol \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_10efb61f","line":800,"updated":"2015-02-21 05:04:37.000000000","message":"call it attribute instead of attri?","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"fc1c53e4db3bc7ffae4618bc40ffaa0b1fb2621c","unresolved":false,"context_lines":[{"line_number":797,"context_line":"                   help\u003d\u0027The protocol name for the tokenless authorization \u0027"},{"line_number":798,"context_line":"                   \u0027along with the Idp name to look up its \u0027"},{"line_number":799,"context_line":"                   \u0027corresponding mapping.\u0027),"},{"line_number":800,"context_line":"        cfg.StrOpt(\u0027issuer_attri\u0027,"},{"line_number":801,"context_line":"                   default\u003d\u0027SSL_CLIENT_I_DN\u0027,"},{"line_number":802,"context_line":"                   help\u003d\u0027The issue attribute that is served as a Idp for \u0027"},{"line_number":803,"context_line":"                   \u0027the tokenless authorization along with the protocol \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_0e54d21f","line":800,"in_reply_to":"ba7be1f8_10efb61f","updated":"2015-02-23 19:11:13.000000000","message":"sure.","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2980c8fc4ec04546375fa362d53b2d238a90cebf","unresolved":false,"context_lines":[{"line_number":799,"context_line":"                   \u0027corresponding mapping.\u0027),"},{"line_number":800,"context_line":"        cfg.StrOpt(\u0027issuer_attri\u0027,"},{"line_number":801,"context_line":"                   default\u003d\u0027SSL_CLIENT_I_DN\u0027,"},{"line_number":802,"context_line":"                   help\u003d\u0027The issue attribute that is served as a Idp for \u0027"},{"line_number":803,"context_line":"                   \u0027the tokenless authorization along with the protocol \u0027"},{"line_number":804,"context_line":"                   \u0027to look up its corresponding mapping.\u0027),"},{"line_number":805,"context_line":"    ],"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_30f4baf1","line":802,"updated":"2015-02-21 05:04:37.000000000","message":"an* IdP*","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8609e4e084b46909ce679e369816740b431ee371","unresolved":false,"context_lines":[{"line_number":833,"context_line":"                   help\u003d\u0027The external (REMOTE_USER) auth plugin module.\u0027),"},{"line_number":834,"context_line":"    ],"},{"line_number":835,"context_line":"    \u0027tokenless_auth\u0027: ["},{"line_number":836,"context_line":"        cfg.StrOpt(\u0027trusted_issuer\u0027,"},{"line_number":837,"context_line":"                   help\u003d\u0027The trusted issuer to further filter the \u0027"},{"line_number":838,"context_line":"                        \u0027certificates that are allowed to participate \u0027"},{"line_number":839,"context_line":"                        \u0027in the tokenless authorization. If its absent, \u0027"}],"source_content_type":"text/x-python","patch_set":12,"id":"9a80dd14_ea7d07b3","line":836,"updated":"2015-03-04 06:38:22.000000000","message":"might want to consider making this a list of trusted_issuers, similar to how federation handles trusted_dashboards for SSO calling back.\n\nbasically just change the config option to ListOpt, and you can now specify multiple trusted issuers by repeating the key\u003dvalue.","commit_id":"550e15b5c613189d1eae6340f2d69dc5536dba64"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"fee15e222162e16b251688101c40468fa1d308b0","unresolved":false,"context_lines":[{"line_number":833,"context_line":"                   help\u003d\u0027The external (REMOTE_USER) auth plugin module.\u0027),"},{"line_number":834,"context_line":"    ],"},{"line_number":835,"context_line":"    \u0027tokenless_auth\u0027: ["},{"line_number":836,"context_line":"        cfg.StrOpt(\u0027trusted_issuer\u0027,"},{"line_number":837,"context_line":"                   help\u003d\u0027The trusted issuer to further filter the \u0027"},{"line_number":838,"context_line":"                        \u0027certificates that are allowed to participate \u0027"},{"line_number":839,"context_line":"                        \u0027in the tokenless authorization. If its absent, \u0027"}],"source_content_type":"text/x-python","patch_set":12,"id":"9a80dd14_3036ae04","line":836,"in_reply_to":"9a80dd14_ea7d07b3","updated":"2015-03-04 07:42:28.000000000","message":"The previous patches actually had this as ListOpt. However, the value of an issuer would contain comas, like \u0027email\u003dfoo.com,cn\u003djohn,o\u003dfoo\u0027, when this is put into a list, there will be an issue with the comas.\nI used the URL escape in order to allow a list of issuers.\nAnd had some discussions with Morgan and ayoung, and they prefer to just support a single trusted issuer for now.","commit_id":"550e15b5c613189d1eae6340f2d69dc5536dba64"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"7875b6a633f827cdbb3352606adfe0c15790b641","unresolved":false,"context_lines":[{"line_number":834,"context_line":"    ],"},{"line_number":835,"context_line":"    \u0027tokenless_auth\u0027: ["},{"line_number":836,"context_line":"        cfg.StrOpt(\u0027trusted_issuer\u0027,"},{"line_number":837,"context_line":"                   help\u003d\u0027The trusted issuer to further filter the \u0027"},{"line_number":838,"context_line":"                        \u0027certificates that are allowed to participate \u0027"},{"line_number":839,"context_line":"                        \u0027in the tokenless authorization. If its absent, \u0027"},{"line_number":840,"context_line":"                        \u0027no certificates will be allowed in the tokenless \u0027"}],"source_content_type":"text/x-python","patch_set":12,"id":"9a80dd14_50f3220a","line":837,"updated":"2015-03-04 07:24:12.000000000","message":"List is better option.\n\nDN is set of \",\" separated entities.  How are you going to distinguish that  for st of DNs","commit_id":"550e15b5c613189d1eae6340f2d69dc5536dba64"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"b5e1abb181363a4ae665762902c5f5f6601e2e2e","unresolved":false,"context_lines":[{"line_number":833,"context_line":"                   help\u003d\u0027The external (REMOTE_USER) auth plugin module.\u0027),"},{"line_number":834,"context_line":"    ],"},{"line_number":835,"context_line":"    \u0027tokenless_auth\u0027: ["},{"line_number":836,"context_line":"        cfg.StrOpt(\u0027trusted_issuer\u0027,"},{"line_number":837,"context_line":"                   help\u003d\u0027The trusted issuer is to further filter the \u0027"},{"line_number":838,"context_line":"                        \u0027certificates that are allowed to participate \u0027"},{"line_number":839,"context_line":"                        \u0027in the tokenless authorization. If it is absent, \u0027"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a80dd14_9449d7d2","line":836,"updated":"2015-03-05 07:56:34.000000000","message":"oops, i meant to look at \u0027cfg.MultiStrOpt\u0027\n\nthis way you can specify \n  trusted_issuer \u003d \u0027CN\u003dfoo,OU\u003dkeystone,O\u003dopenstack\u0027\n  trusted_issuer \u003d \u0027CN\u003dbar,OU\u003dkeystone,O\u003dopenstack\u0027\n\nit will all be in an array, which should default to []","commit_id":"7ac24a995cc44037e6c8e7003ee3b6d054eee0a5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"ff0c835f3f0362d1e610e584a93064d49c7a05b9","unresolved":false,"context_lines":[{"line_number":833,"context_line":"                   help\u003d\u0027The external (REMOTE_USER) auth plugin module.\u0027),"},{"line_number":834,"context_line":"    ],"},{"line_number":835,"context_line":"    \u0027tokenless_auth\u0027: ["},{"line_number":836,"context_line":"        cfg.StrOpt(\u0027trusted_issuer\u0027,"},{"line_number":837,"context_line":"                   help\u003d\u0027The trusted issuer is to further filter the \u0027"},{"line_number":838,"context_line":"                        \u0027certificates that are allowed to participate \u0027"},{"line_number":839,"context_line":"                        \u0027in the tokenless authorization. If it is absent, \u0027"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a80dd14_32f91bea","line":836,"in_reply_to":"9a80dd14_9449d7d2","updated":"2015-03-05 08:12:29.000000000","message":"Will definitely look into the type","commit_id":"7ac24a995cc44037e6c8e7003ee3b6d054eee0a5"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"2aa069144e5a41481bd62d675e0efa48e0a737e4","unresolved":false,"context_lines":[{"line_number":856,"context_line":"                             \u0027multiple values. For example: \u0027"},{"line_number":857,"context_line":"                             \u0027trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack\u0027"},{"line_number":858,"context_line":"                             \u0027trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc\u0027),"},{"line_number":859,"context_line":"        cfg.StrOpt(\u0027protocol\u0027, default\u003d\u0027x509\u0027,"},{"line_number":860,"context_line":"                   help\u003d\u0027The protocol name for the tokenless authorization \u0027"},{"line_number":861,"context_line":"                        \u0027along with the IdP name to look up its \u0027"},{"line_number":862,"context_line":"                        \u0027corresponding mapping.\u0027),"}],"source_content_type":"text/x-python","patch_set":21,"id":"baa041b7_fc02c23d","line":859,"updated":"2015-04-02 12:52:41.000000000","message":"Make this a list, as we can allow X509, Kerberos, etc.","commit_id":"965ba1ea6cb25d1b6fd4620c2e17266c318a6fec"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"ee32e78845d1e57cdd41dfdf85b54fd7652f10e9","unresolved":false,"context_lines":[{"line_number":856,"context_line":"                             \u0027multiple values. For example: \u0027"},{"line_number":857,"context_line":"                             \u0027trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack\u0027"},{"line_number":858,"context_line":"                             \u0027trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc\u0027),"},{"line_number":859,"context_line":"        cfg.StrOpt(\u0027protocol\u0027, default\u003d\u0027x509\u0027,"},{"line_number":860,"context_line":"                   help\u003d\u0027The protocol name for the tokenless authorization \u0027"},{"line_number":861,"context_line":"                        \u0027along with the IdP name to look up its \u0027"},{"line_number":862,"context_line":"                        \u0027corresponding mapping.\u0027),"}],"source_content_type":"text/x-python","patch_set":21,"id":"dac4157f_86bb6672","line":859,"in_reply_to":"baa041b7_438634ba","updated":"2015-04-20 20:55:05.000000000","message":"umm.. I think I changed my mind as I think this makes more sense to keep it as a single item. My intention to these options are more specific for the x509 auth. Having the default as \u0027x509\u0027 should be good for most of the cases as it\u0027s basically a name to help alone with the IdP Id to look up for an user.","commit_id":"965ba1ea6cb25d1b6fd4620c2e17266c318a6fec"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"386ffe0cf56283202adfa9151e6d2ac07a6f7662","unresolved":false,"context_lines":[{"line_number":856,"context_line":"                             \u0027multiple values. For example: \u0027"},{"line_number":857,"context_line":"                             \u0027trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack\u0027"},{"line_number":858,"context_line":"                             \u0027trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc\u0027),"},{"line_number":859,"context_line":"        cfg.StrOpt(\u0027protocol\u0027, default\u003d\u0027x509\u0027,"},{"line_number":860,"context_line":"                   help\u003d\u0027The protocol name for the tokenless authorization \u0027"},{"line_number":861,"context_line":"                        \u0027along with the IdP name to look up its \u0027"},{"line_number":862,"context_line":"                        \u0027corresponding mapping.\u0027),"}],"source_content_type":"text/x-python","patch_set":21,"id":"baa041b7_438634ba","line":859,"in_reply_to":"baa041b7_fc02c23d","updated":"2015-04-03 22:46:20.000000000","message":"sure","commit_id":"965ba1ea6cb25d1b6fd4620c2e17266c318a6fec"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":855,"context_line":"                             \u0027comma and contains no spaces. This \u0027"},{"line_number":856,"context_line":"                             \u0027configuration option may be repeated for \u0027"},{"line_number":857,"context_line":"                             \u0027multiple values. For example: \u0027"},{"line_number":858,"context_line":"                             \u0027trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack\u0027"},{"line_number":859,"context_line":"                             \u0027trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc\u0027),"},{"line_number":860,"context_line":"        cfg.StrOpt(\u0027protocol\u0027, default\u003d\u0027x509\u0027,"},{"line_number":861,"context_line":"                   help\u003d\u0027The protocol name for the X.509 tokenless \u0027"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_0824ecac","line":858,"updated":"2015-05-01 15:51:04.000000000","message":"the formatting here isn\u0027t going to make it to the sample config file.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":855,"context_line":"                             \u0027comma and contains no spaces. This \u0027"},{"line_number":856,"context_line":"                             \u0027configuration option may be repeated for \u0027"},{"line_number":857,"context_line":"                             \u0027multiple values. For example: \u0027"},{"line_number":858,"context_line":"                             \u0027trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack\u0027"},{"line_number":859,"context_line":"                             \u0027trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc\u0027),"},{"line_number":860,"context_line":"        cfg.StrOpt(\u0027protocol\u0027, default\u003d\u0027x509\u0027,"},{"line_number":861,"context_line":"                   help\u003d\u0027The protocol name for the X.509 tokenless \u0027"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_142d2246","line":858,"in_reply_to":"3acd31a7_0824ecac","updated":"2015-05-01 21:28:34.000000000","message":"ok, will look it up how it is supposed to be formatted.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":854,"context_line":"                             \u0027The value of an DN must be separated by a \u0027"},{"line_number":855,"context_line":"                             \u0027comma and contains no spaces. This \u0027"},{"line_number":856,"context_line":"                             \u0027configuration option may be repeated for \u0027"},{"line_number":857,"context_line":"                             \u0027multiple values. For example:: \u0027"},{"line_number":858,"context_line":"                             \u0027trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack \u0027"},{"line_number":859,"context_line":"                             \u0027trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc\u0027),"},{"line_number":860,"context_line":"        cfg.BoolOpt(\u0027no_check_trusted_issuer\u0027, default\u003dFalse,"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_8fab6789","line":857,"updated":"2015-05-13 02:18:51.000000000","message":"remove the extra :","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"b81d99886a6cf8c9fdcdd4b295defef6b8d389be","unresolved":false,"context_lines":[{"line_number":857,"context_line":"                             \u0027multiple values. For example:: \u0027"},{"line_number":858,"context_line":"                             \u0027trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack \u0027"},{"line_number":859,"context_line":"                             \u0027trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc\u0027),"},{"line_number":860,"context_line":"        cfg.BoolOpt(\u0027no_check_trusted_issuer\u0027, default\u003dFalse,"},{"line_number":861,"context_line":"                    help\u003d\u0027Setting this option to True will disable the \u0027"},{"line_number":862,"context_line":"                         \u0027validation checking on the trusted issuer from the\u0027"},{"line_number":863,"context_line":"                         \u0027client certificate. The trust validation will all\u0027"}],"source_content_type":"text/x-python","patch_set":26,"id":"7a016987_7ba11ca9","line":860,"updated":"2015-05-14 23:00:54.000000000","message":"There\u0027s no need for this option. We are checking for trusted issuer one way or the other because their are linked to the identity providers. Please remove this option.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":858,"context_line":"                             \u0027trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack \u0027"},{"line_number":859,"context_line":"                             \u0027trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc\u0027),"},{"line_number":860,"context_line":"        cfg.BoolOpt(\u0027no_check_trusted_issuer\u0027, default\u003dFalse,"},{"line_number":861,"context_line":"                    help\u003d\u0027Setting this option to True will disable the \u0027"},{"line_number":862,"context_line":"                         \u0027validation checking on the trusted issuer from the\u0027"},{"line_number":863,"context_line":"                         \u0027client certificate. The trust validation will all\u0027"},{"line_number":864,"context_line":"                         \u0027be replied on the web container configuration. \u0027"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_0fa0979e","line":861,"updated":"2015-05-13 02:18:51.000000000","message":"use \"true\" rather than \"True\"\n\nchange \"the validation\" to \"validation\"","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":859,"context_line":"                             \u0027trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc\u0027),"},{"line_number":860,"context_line":"        cfg.BoolOpt(\u0027no_check_trusted_issuer\u0027, default\u003dFalse,"},{"line_number":861,"context_line":"                    help\u003d\u0027Setting this option to True will disable the \u0027"},{"line_number":862,"context_line":"                         \u0027validation checking on the trusted issuer from the\u0027"},{"line_number":863,"context_line":"                         \u0027client certificate. The trust validation will all\u0027"},{"line_number":864,"context_line":"                         \u0027be replied on the web container configuration. \u0027"},{"line_number":865,"context_line":"                         \u0027Therefore, this can be risky!\u0027),"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_8f8247ff","line":862,"updated":"2015-05-13 02:18:51.000000000","message":"change \"on the trusted\" to \"to the trusted\"","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":860,"context_line":"        cfg.BoolOpt(\u0027no_check_trusted_issuer\u0027, default\u003dFalse,"},{"line_number":861,"context_line":"                    help\u003d\u0027Setting this option to True will disable the \u0027"},{"line_number":862,"context_line":"                         \u0027validation checking on the trusted issuer from the\u0027"},{"line_number":863,"context_line":"                         \u0027client certificate. The trust validation will all\u0027"},{"line_number":864,"context_line":"                         \u0027be replied on the web container configuration. \u0027"},{"line_number":865,"context_line":"                         \u0027Therefore, this can be risky!\u0027),"},{"line_number":866,"context_line":"        cfg.StrOpt(\u0027protocol\u0027, default\u003d\u0027x509\u0027,"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_6f871310","line":863,"updated":"2015-05-13 02:18:51.000000000","message":"change \"all be replied\" to \"rely\"","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":862,"context_line":"                         \u0027validation checking on the trusted issuer from the\u0027"},{"line_number":863,"context_line":"                         \u0027client certificate. The trust validation will all\u0027"},{"line_number":864,"context_line":"                         \u0027be replied on the web container configuration. \u0027"},{"line_number":865,"context_line":"                         \u0027Therefore, this can be risky!\u0027),"},{"line_number":866,"context_line":"        cfg.StrOpt(\u0027protocol\u0027, default\u003d\u0027x509\u0027,"},{"line_number":867,"context_line":"                   help\u003d\u0027The protocol name for the X.509 tokenless \u0027"},{"line_number":868,"context_line":"                        \u0027authorization along with the IdP name to look up \u0027"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_4f7d6f1b","line":865,"updated":"2015-05-13 02:18:51.000000000","message":"remove this sentence since it doesn\u0027t add anything.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":872,"context_line":"                        \u0027the X.509 tokenless authorization along with the \u0027"},{"line_number":873,"context_line":"                        \u0027protocol to look up its corresponding mapping.\u0027),"},{"line_number":874,"context_line":"        cfg.BoolOpt(\u0027ephemeral_user\u0027, default\u003dFalse,"},{"line_number":875,"context_line":"                    help\u003d\u0027When setting this option to True, the user \u0027"},{"line_number":876,"context_line":"                         \u0027referenced from the client certificate CN does \u0027"},{"line_number":877,"context_line":"                         \u0027not need to exist in the system. A group needs \u0027"},{"line_number":878,"context_line":"                         \u0027to be defined in the corresponding mapping and \u0027"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_0f77773b","line":875,"updated":"2015-05-13 02:18:51.000000000","message":"change \"True\" to \"true\"","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":876,"context_line":"                         \u0027referenced from the client certificate CN does \u0027"},{"line_number":877,"context_line":"                         \u0027not need to exist in the system. A group needs \u0027"},{"line_number":878,"context_line":"                         \u0027to be defined in the corresponding mapping and \u0027"},{"line_number":879,"context_line":"                         \u0027this ephemeral user will have the same role as \u0027"},{"line_number":880,"context_line":"                         \u0027what is assigned to the group.\u0027),"},{"line_number":881,"context_line":"    ],"},{"line_number":882,"context_line":"    \u0027paste_deploy\u0027: ["}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_8f992771","line":879,"updated":"2015-05-13 02:18:51.000000000","message":"change \"role\" to \"roles\"","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"a2cab849c5e8441c44c399393084b3484b548c58","unresolved":false,"context_lines":[{"line_number":869,"context_line":"                             \u0027comma and contain no spaces. This configuration \u0027"},{"line_number":870,"context_line":"                             \u0027option may be repeated for multiple values. \u0027"},{"line_number":871,"context_line":"                             \u0027For example: \u0027"},{"line_number":872,"context_line":"                             \u0027trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack \u0027"},{"line_number":873,"context_line":"                             \u0027trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc\u0027),"},{"line_number":874,"context_line":"        cfg.StrOpt(\u0027protocol\u0027, default\u003d\u0027x509\u0027,"},{"line_number":875,"context_line":"                   help\u003d\u0027The protocol name for the X.509 tokenless \u0027"}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_ffc8ed56","line":872,"updated":"2015-07-15 19:57:47.000000000","message":"should there be an \u0027or\u0027 here so the two examples are seen as separate?","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"8ada87ee5b062ac22c3cd494fd285e3982f06c4e","unresolved":false,"context_lines":[{"line_number":869,"context_line":"                             \u0027comma and contain no spaces. This configuration \u0027"},{"line_number":870,"context_line":"                             \u0027option may be repeated for multiple values. \u0027"},{"line_number":871,"context_line":"                             \u0027For example: \u0027"},{"line_number":872,"context_line":"                             \u0027trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack \u0027"},{"line_number":873,"context_line":"                             \u0027trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc\u0027),"},{"line_number":874,"context_line":"        cfg.StrOpt(\u0027protocol\u0027, default\u003d\u0027x509\u0027,"},{"line_number":875,"context_line":"                   help\u003d\u0027The protocol name for the X.509 tokenless \u0027"}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_f387c6b2","line":872,"in_reply_to":"9a41bdd9_ffc8ed56","updated":"2015-07-16 02:50:56.000000000","message":"I think that\u0027s how we specific multi-string value.","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":10311,"name":"Joseph Davis","email":"joseph.davis@suse.com","username":"joadavis"},"change_message_id":"16dab03d3ebf21137da82ea89d09555e2b062fa6","unresolved":false,"context_lines":[{"line_number":873,"context_line":"                             \u0027trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc\u0027),"},{"line_number":874,"context_line":"        cfg.StrOpt(\u0027protocol\u0027, default\u003d\u0027x509\u0027,"},{"line_number":875,"context_line":"                   help\u003d\u0027The protocol name for the X.509 tokenless \u0027"},{"line_number":876,"context_line":"                        \u0027authorization along with the IdP name to look up \u0027"},{"line_number":877,"context_line":"                        \u0027its corresponding mapping.\u0027),"},{"line_number":878,"context_line":"        cfg.StrOpt(\u0027issuer_attribute\u0027, default\u003d\u0027SSL_CLIENT_I_DN\u0027,"},{"line_number":879,"context_line":"                   help\u003d\u0027The issuer attribute that is served as a IdP for \u0027"}],"source_content_type":"text/x-python","patch_set":32,"id":"ba3cc151_c05cfe7f","line":876,"updated":"2015-07-09 23:52:41.000000000","message":"Is the IdP name also specified in this parameter?  This help string indicates it is.","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"635a96eca050e869fe5b34400a865f622f9bb5bd","unresolved":false,"context_lines":[{"line_number":873,"context_line":"                             \u0027trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc\u0027),"},{"line_number":874,"context_line":"        cfg.StrOpt(\u0027protocol\u0027, default\u003d\u0027x509\u0027,"},{"line_number":875,"context_line":"                   help\u003d\u0027The protocol name for the X.509 tokenless \u0027"},{"line_number":876,"context_line":"                        \u0027authorization along with the IdP name to look up \u0027"},{"line_number":877,"context_line":"                        \u0027its corresponding mapping.\u0027),"},{"line_number":878,"context_line":"        cfg.StrOpt(\u0027issuer_attribute\u0027, default\u003d\u0027SSL_CLIENT_I_DN\u0027,"},{"line_number":879,"context_line":"                   help\u003d\u0027The issuer attribute that is served as a IdP for \u0027"}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_bf7b45bd","line":876,"in_reply_to":"ba3cc151_c05cfe7f","updated":"2015-07-15 19:40:29.000000000","message":"No, the IdP is the hash of the issuer\u0027s subject DN.","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":10311,"name":"Joseph Davis","email":"joseph.davis@suse.com","username":"joadavis"},"change_message_id":"16dab03d3ebf21137da82ea89d09555e2b062fa6","unresolved":false,"context_lines":[{"line_number":879,"context_line":"                   help\u003d\u0027The issuer attribute that is served as a IdP for \u0027"},{"line_number":880,"context_line":"                        \u0027the X.509 tokenless authorization along with the \u0027"},{"line_number":881,"context_line":"                        \u0027protocol to look up its corresponding mapping.\u0027"},{"line_number":882,"context_line":"                        \u0027It is the attribute name in the WSGI enviornment \u0027"},{"line_number":883,"context_line":"                        \u0027that references to the Issuer of the client \u0027"},{"line_number":884,"context_line":"                        \u0027certificate.\u0027),"},{"line_number":885,"context_line":"        cfg.BoolOpt(\u0027ephemeral_user\u0027, default\u003dFalse,"}],"source_content_type":"text/x-python","patch_set":32,"id":"ba3cc151_e0eb427a","line":882,"updated":"2015-07-09 23:52:41.000000000","message":"nitpick: enviornment should be environment","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"635a96eca050e869fe5b34400a865f622f9bb5bd","unresolved":false,"context_lines":[{"line_number":879,"context_line":"                   help\u003d\u0027The issuer attribute that is served as a IdP for \u0027"},{"line_number":880,"context_line":"                        \u0027the X.509 tokenless authorization along with the \u0027"},{"line_number":881,"context_line":"                        \u0027protocol to look up its corresponding mapping.\u0027"},{"line_number":882,"context_line":"                        \u0027It is the attribute name in the WSGI enviornment \u0027"},{"line_number":883,"context_line":"                        \u0027that references to the Issuer of the client \u0027"},{"line_number":884,"context_line":"                        \u0027certificate.\u0027),"},{"line_number":885,"context_line":"        cfg.BoolOpt(\u0027ephemeral_user\u0027, default\u003dFalse,"}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_7f37fdfe","line":882,"in_reply_to":"ba3cc151_e0eb427a","updated":"2015-07-15 19:40:29.000000000","message":"good catch!","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"74ac95ebdfff974d0a5cc214d818b424765cf432","unresolved":false,"context_lines":[{"line_number":869,"context_line":"                             \u0027comma and contain no spaces. This configuration \u0027"},{"line_number":870,"context_line":"                             \u0027option may be repeated for multiple values. \u0027"},{"line_number":871,"context_line":"                             \u0027For example: \u0027"},{"line_number":872,"context_line":"                             \u0027trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack \u0027"},{"line_number":873,"context_line":"                             \u0027trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc\u0027),"},{"line_number":874,"context_line":"        cfg.StrOpt(\u0027protocol\u0027, default\u003d\u0027x509\u0027,"},{"line_number":875,"context_line":"                   help\u003d\u0027The protocol name for the X.509 tokenless \u0027"}],"source_content_type":"text/x-python","patch_set":36,"id":"9a41bdd9_737628da","line":872,"updated":"2015-07-16 15:16:03.000000000","message":"trusted_issuer","commit_id":"78ee5cff332c817fa9bf3ac81ca49d0d476b40fe"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"36f9ae2f69d420a76d9eeb4488d8f3578508b7b1","unresolved":false,"context_lines":[{"line_number":869,"context_line":"                             \u0027comma and contain no spaces. This configuration \u0027"},{"line_number":870,"context_line":"                             \u0027option may be repeated for multiple values. \u0027"},{"line_number":871,"context_line":"                             \u0027For example: \u0027"},{"line_number":872,"context_line":"                             \u0027trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack \u0027"},{"line_number":873,"context_line":"                             \u0027trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc\u0027),"},{"line_number":874,"context_line":"        cfg.StrOpt(\u0027protocol\u0027, default\u003d\u0027x509\u0027,"},{"line_number":875,"context_line":"                   help\u003d\u0027The protocol name for the X.509 tokenless \u0027"}],"source_content_type":"text/x-python","patch_set":36,"id":"9a41bdd9_12030d78","line":872,"in_reply_to":"9a41bdd9_737628da","updated":"2015-07-16 18:17:52.000000000","message":"done. Good catch!","commit_id":"78ee5cff332c817fa9bf3ac81ca49d0d476b40fe"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"74ac95ebdfff974d0a5cc214d818b424765cf432","unresolved":false,"context_lines":[{"line_number":870,"context_line":"                             \u0027option may be repeated for multiple values. \u0027"},{"line_number":871,"context_line":"                             \u0027For example: \u0027"},{"line_number":872,"context_line":"                             \u0027trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack \u0027"},{"line_number":873,"context_line":"                             \u0027trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc\u0027),"},{"line_number":874,"context_line":"        cfg.StrOpt(\u0027protocol\u0027, default\u003d\u0027x509\u0027,"},{"line_number":875,"context_line":"                   help\u003d\u0027The protocol name for the X.509 tokenless \u0027"},{"line_number":876,"context_line":"                        \u0027authorization along with the IdP name to look up \u0027"}],"source_content_type":"text/x-python","patch_set":36,"id":"9a41bdd9_3380a08b","line":873,"updated":"2015-07-16 15:16:03.000000000","message":"trusted_issuer","commit_id":"78ee5cff332c817fa9bf3ac81ca49d0d476b40fe"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"36f9ae2f69d420a76d9eeb4488d8f3578508b7b1","unresolved":false,"context_lines":[{"line_number":870,"context_line":"                             \u0027option may be repeated for multiple values. \u0027"},{"line_number":871,"context_line":"                             \u0027For example: \u0027"},{"line_number":872,"context_line":"                             \u0027trusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack \u0027"},{"line_number":873,"context_line":"                             \u0027trusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc\u0027),"},{"line_number":874,"context_line":"        cfg.StrOpt(\u0027protocol\u0027, default\u003d\u0027x509\u0027,"},{"line_number":875,"context_line":"                   help\u003d\u0027The protocol name for the X.509 tokenless \u0027"},{"line_number":876,"context_line":"                        \u0027authorization along with the IdP name to look up \u0027"}],"source_content_type":"text/x-python","patch_set":36,"id":"9a41bdd9_f201c96b","line":873,"in_reply_to":"9a41bdd9_3380a08b","updated":"2015-07-16 18:17:52.000000000","message":"done","commit_id":"78ee5cff332c817fa9bf3ac81ca49d0d476b40fe"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"74ac95ebdfff974d0a5cc214d818b424765cf432","unresolved":false,"context_lines":[{"line_number":883,"context_line":"                        \u0027that references to the Issuer of the client \u0027"},{"line_number":884,"context_line":"                        \u0027certificate.\u0027),"},{"line_number":885,"context_line":"        cfg.BoolOpt(\u0027ephemeral_user\u0027, default\u003dFalse,"},{"line_number":886,"context_line":"                    help\u003d\u0027If this option is true, the user referenced\u0027"},{"line_number":887,"context_line":"                         \u0027from the client certificate CN does not need \u0027"},{"line_number":888,"context_line":"                         \u0027to exist. A group needs to be defined in the \u0027"},{"line_number":889,"context_line":"                         \u0027corresponding mapping and this ephemeral user \u0027"}],"source_content_type":"text/x-python","patch_set":36,"id":"9a41bdd9_7324e8c5","line":886,"updated":"2015-07-16 15:16:03.000000000","message":"missing space at the end","commit_id":"78ee5cff332c817fa9bf3ac81ca49d0d476b40fe"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"36f9ae2f69d420a76d9eeb4488d8f3578508b7b1","unresolved":false,"context_lines":[{"line_number":883,"context_line":"                        \u0027that references to the Issuer of the client \u0027"},{"line_number":884,"context_line":"                        \u0027certificate.\u0027),"},{"line_number":885,"context_line":"        cfg.BoolOpt(\u0027ephemeral_user\u0027, default\u003dFalse,"},{"line_number":886,"context_line":"                    help\u003d\u0027If this option is true, the user referenced\u0027"},{"line_number":887,"context_line":"                         \u0027from the client certificate CN does not need \u0027"},{"line_number":888,"context_line":"                         \u0027to exist. A group needs to be defined in the \u0027"},{"line_number":889,"context_line":"                         \u0027corresponding mapping and this ephemeral user \u0027"}],"source_content_type":"text/x-python","patch_set":36,"id":"9a41bdd9_72ee19b6","line":886,"in_reply_to":"9a41bdd9_7324e8c5","updated":"2015-07-16 18:17:52.000000000","message":"done","commit_id":"78ee5cff332c817fa9bf3ac81ca49d0d476b40fe"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"61544dd1dcfe12d262b2ee2d717d58a2a4acbe5a","unresolved":false,"context_lines":[{"line_number":880,"context_line":"                        \u0027the X.509 tokenless authorization along with the \u0027"},{"line_number":881,"context_line":"                        \u0027protocol to look up its corresponding mapping.\u0027"},{"line_number":882,"context_line":"                        \u0027It is the attribute name in the WSGI environment \u0027"},{"line_number":883,"context_line":"                        \u0027that references to the Issuer of the client \u0027"},{"line_number":884,"context_line":"                        \u0027certificate.\u0027),"},{"line_number":885,"context_line":"        cfg.BoolOpt(\u0027ephemeral_user\u0027, default\u003dFalse,"},{"line_number":886,"context_line":"                    help\u003d\u0027If this option is true, the user referenced \u0027"}],"source_content_type":"text/x-python","patch_set":38,"id":"9a41bdd9_71da9619","line":883,"updated":"2015-07-16 19:31:47.000000000","message":"issuer","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"bdcce290eed05722deaca8c9775b49517d0f8917","unresolved":false,"context_lines":[{"line_number":880,"context_line":"                        \u0027the X.509 tokenless authorization along with the \u0027"},{"line_number":881,"context_line":"                        \u0027protocol to look up its corresponding mapping.\u0027"},{"line_number":882,"context_line":"                        \u0027It is the attribute name in the WSGI environment \u0027"},{"line_number":883,"context_line":"                        \u0027that references to the Issuer of the client \u0027"},{"line_number":884,"context_line":"                        \u0027certificate.\u0027),"},{"line_number":885,"context_line":"        cfg.BoolOpt(\u0027ephemeral_user\u0027, default\u003dFalse,"},{"line_number":886,"context_line":"                    help\u003d\u0027If this option is true, the user referenced \u0027"}],"source_content_type":"text/x-python","patch_set":38,"id":"9a41bdd9_5aed2724","line":883,"in_reply_to":"9a41bdd9_71da9619","updated":"2015-07-16 20:18:50.000000000","message":"done","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"99a8e51e8bba3291f7b20118fe500016df0ab8ac","unresolved":false,"context_lines":[{"line_number":905,"context_line":"        cfg.StrOpt(\u0027issuer_attribute\u0027, default\u003d\u0027SSL_CLIENT_I_DN\u0027,"},{"line_number":906,"context_line":"                   help\u003d\u0027The issuer attribute that is served as a IdP for \u0027"},{"line_number":907,"context_line":"                        \u0027the X.509 tokenless authorization along with the \u0027"},{"line_number":908,"context_line":"                        \u0027protocol to look up its corresponding mapping.\u0027"},{"line_number":909,"context_line":"                        \u0027It is the attribute name in the WSGI environment \u0027"},{"line_number":910,"context_line":"                        \u0027that references to the issuer of the client \u0027"},{"line_number":911,"context_line":"                        \u0027certificate.\u0027),"}],"source_content_type":"text/x-python","patch_set":47,"id":"3a50d1a3_ace50439","line":908,"updated":"2015-07-30 19:16:53.000000000","message":"add space after the period","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"288bb4dade83c0212c1f9f86638d0843b09cae40","unresolved":false,"context_lines":[{"line_number":905,"context_line":"        cfg.StrOpt(\u0027issuer_attribute\u0027, default\u003d\u0027SSL_CLIENT_I_DN\u0027,"},{"line_number":906,"context_line":"                   help\u003d\u0027The issuer attribute that is served as a IdP for \u0027"},{"line_number":907,"context_line":"                        \u0027the X.509 tokenless authorization along with the \u0027"},{"line_number":908,"context_line":"                        \u0027protocol to look up its corresponding mapping.\u0027"},{"line_number":909,"context_line":"                        \u0027It is the attribute name in the WSGI environment \u0027"},{"line_number":910,"context_line":"                        \u0027that references to the issuer of the client \u0027"},{"line_number":911,"context_line":"                        \u0027certificate.\u0027),"}],"source_content_type":"text/x-python","patch_set":47,"id":"3a50d1a3_981126b2","line":908,"in_reply_to":"3a50d1a3_ace50439","updated":"2015-07-31 21:31:31.000000000","message":"done","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"c07aa71e62729635f59c653e13b216cfbd5587d5","unresolved":false,"context_lines":[{"line_number":909,"context_line":"                        \u0027It is the attribute name in the WSGI environment \u0027"},{"line_number":910,"context_line":"                        \u0027that references to the issuer of the client \u0027"},{"line_number":911,"context_line":"                        \u0027certificate.\u0027),"},{"line_number":912,"context_line":"        cfg.BoolOpt(\u0027ephemeral_user\u0027, default\u003dFalse,"},{"line_number":913,"context_line":"                    help\u003d\u0027If this option is true, the user referenced \u0027"},{"line_number":914,"context_line":"                         \u0027from the client certificate CN does not need \u0027"},{"line_number":915,"context_line":"                         \u0027to exist. A group needs to be defined in the \u0027"}],"source_content_type":"text/x-python","patch_set":51,"id":"fa1b9901_7956d107","line":912,"updated":"2015-08-24 08:24:51.000000000","message":"why adding this instead of checking the mapping? \nuser has already a keyword \u0027type\u0027 which can be eiter \u0027ephemeral\u0027 or \u0027local\u0027 (defaulting to \u0027ephemeral\u0027 due to backwards compatibility).\nWe can also test user type by checking the domain.","commit_id":"572a18af0e8520b2fa284bc2f97410be1be96e7e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"a3198243d376815899b6d88deb82b97271a87cbe","unresolved":false,"context_lines":[{"line_number":909,"context_line":"                        \u0027It is the attribute name in the WSGI environment \u0027"},{"line_number":910,"context_line":"                        \u0027that references to the issuer of the client \u0027"},{"line_number":911,"context_line":"                        \u0027certificate.\u0027),"},{"line_number":912,"context_line":"        cfg.BoolOpt(\u0027ephemeral_user\u0027, default\u003dFalse,"},{"line_number":913,"context_line":"                    help\u003d\u0027If this option is true, the user referenced \u0027"},{"line_number":914,"context_line":"                         \u0027from the client certificate CN does not need \u0027"},{"line_number":915,"context_line":"                         \u0027to exist. A group needs to be defined in the \u0027"}],"source_content_type":"text/x-python","patch_set":51,"id":"fa1b9901_903a7e33","line":912,"in_reply_to":"fa1b9901_7956d107","updated":"2015-08-24 17:29:33.000000000","message":"good to know, will look into it.","commit_id":"572a18af0e8520b2fa284bc2f97410be1be96e7e"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"b855d7436c76de567dae2d6451b38b78d528dffd","unresolved":false,"context_lines":[{"line_number":884,"context_line":"                        \u0027the keystone.auth.oauth1 namespace.\u0027),"},{"line_number":885,"context_line":"    ],"},{"line_number":886,"context_line":"    \u0027tokenless_auth\u0027: ["},{"line_number":887,"context_line":"        cfg.MultiStrOpt(\u0027trusted_issuer\u0027, default\u003d[],"},{"line_number":888,"context_line":"                        help\u003d\u0027The list of trusted issuers to further filter \u0027"},{"line_number":889,"context_line":"                             \u0027the certificates that are allowed to \u0027"},{"line_number":890,"context_line":"                             \u0027participate in the X.509 tokenless \u0027"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_2c5339e3","line":887,"updated":"2015-08-27 12:57:53.000000000","message":"so each reconfigurtion will require restarting the server(s) ? :(","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"d9e08f1ceb45ea04555b48d7b3fb86fd0991fe85","unresolved":false,"context_lines":[{"line_number":884,"context_line":"                        \u0027the keystone.auth.oauth1 namespace.\u0027),"},{"line_number":885,"context_line":"    ],"},{"line_number":886,"context_line":"    \u0027tokenless_auth\u0027: ["},{"line_number":887,"context_line":"        cfg.MultiStrOpt(\u0027trusted_issuer\u0027, default\u003d[],"},{"line_number":888,"context_line":"                        help\u003d\u0027The list of trusted issuers to further filter \u0027"},{"line_number":889,"context_line":"                             \u0027the certificates that are allowed to \u0027"},{"line_number":890,"context_line":"                             \u0027participate in the X.509 tokenless \u0027"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_2ad546b8","line":887,"in_reply_to":"da20952f_2c5339e3","updated":"2015-08-27 22:42:00.000000000","message":"It is not introducing anything new,  just likes all the other configuration changes will request server restart.\nAnd this list of trusted issuer should not be changed very often.","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"b855d7436c76de567dae2d6451b38b78d528dffd","unresolved":false,"context_lines":[{"line_number":889,"context_line":"                             \u0027the certificates that are allowed to \u0027"},{"line_number":890,"context_line":"                             \u0027participate in the X.509 tokenless \u0027"},{"line_number":891,"context_line":"                             \u0027authorization. If the option is absent and \u0027"},{"line_number":892,"context_line":"                             \u0027check_trusted_issuer is true then no \u0027"},{"line_number":893,"context_line":"                             \u0027certificates will be allowed. \u0027"},{"line_number":894,"context_line":"                             \u0027The naming format for the attributes of a \u0027"},{"line_number":895,"context_line":"                             \u0027Distinguished Name(DN) must be separated by a \u0027"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_6c705173","line":892,"updated":"2015-08-27 12:57:53.000000000","message":"where is this \"check_trusted_issuer\" option is defined? Apache?","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"d9e08f1ceb45ea04555b48d7b3fb86fd0991fe85","unresolved":false,"context_lines":[{"line_number":889,"context_line":"                             \u0027the certificates that are allowed to \u0027"},{"line_number":890,"context_line":"                             \u0027participate in the X.509 tokenless \u0027"},{"line_number":891,"context_line":"                             \u0027authorization. If the option is absent and \u0027"},{"line_number":892,"context_line":"                             \u0027check_trusted_issuer is true then no \u0027"},{"line_number":893,"context_line":"                             \u0027certificates will be allowed. \u0027"},{"line_number":894,"context_line":"                             \u0027The naming format for the attributes of a \u0027"},{"line_number":895,"context_line":"                             \u0027Distinguished Name(DN) must be separated by a \u0027"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_6ac01ee1","line":892,"in_reply_to":"da20952f_6c705173","updated":"2015-08-27 22:42:00.000000000","message":"good catch. this option is no longer valid, it was in the earlier patches ;-)\nwill remove it.","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d338bea3e6ae19a1c958d7d99347292a831b7bb3","unresolved":false,"context_lines":[{"line_number":900,"context_line":"                             \u0027trusted_issuer\u003dCN\u003dmary,OU\u003deng,O\u003dabc\u0027),"},{"line_number":901,"context_line":"        cfg.StrOpt(\u0027protocol\u0027, default\u003d\u0027x509\u0027,"},{"line_number":902,"context_line":"                   help\u003d\u0027The protocol name for the X.509 tokenless \u0027"},{"line_number":903,"context_line":"                        \u0027authorization along with the IdP name to look up \u0027"},{"line_number":904,"context_line":"                        \u0027its corresponding mapping.\u0027),"},{"line_number":905,"context_line":"        cfg.StrOpt(\u0027issuer_attribute\u0027, default\u003d\u0027SSL_CLIENT_I_DN\u0027,"},{"line_number":906,"context_line":"                   help\u003d\u0027The issuer attribute that is served as a IdP for \u0027"}],"source_content_type":"text/x-python","patch_set":56,"id":"da20952f_52a16893","line":903,"updated":"2015-08-27 13:34:49.000000000","message":"The \"along with\" seems to indicate that the setting should contain the protocol and IdP.","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"019cbb1766bd174d043356f6de9920ffb207767e","unresolved":false,"context_lines":[{"line_number":900,"context_line":"                             \u0027trusted_issuer\u003dCN\u003dmary,OU\u003deng,O\u003dabc\u0027),"},{"line_number":901,"context_line":"        cfg.StrOpt(\u0027protocol\u0027, default\u003d\u0027x509\u0027,"},{"line_number":902,"context_line":"                   help\u003d\u0027The protocol name for the X.509 tokenless \u0027"},{"line_number":903,"context_line":"                        \u0027authorization along with the IdP name to look up \u0027"},{"line_number":904,"context_line":"                        \u0027its corresponding mapping.\u0027),"},{"line_number":905,"context_line":"        cfg.StrOpt(\u0027issuer_attribute\u0027, default\u003d\u0027SSL_CLIENT_I_DN\u0027,"},{"line_number":906,"context_line":"                   help\u003d\u0027The issuer attribute that is served as a IdP for \u0027"}],"source_content_type":"text/x-python","patch_set":56,"id":"da20952f_f635fe45","line":903,"in_reply_to":"da20952f_52a16893","updated":"2015-08-27 18:19:47.000000000","message":"will change the wording.","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d338bea3e6ae19a1c958d7d99347292a831b7bb3","unresolved":false,"context_lines":[{"line_number":906,"context_line":"                   help\u003d\u0027The issuer attribute that is served as a IdP for \u0027"},{"line_number":907,"context_line":"                        \u0027the X.509 tokenless authorization along with the \u0027"},{"line_number":908,"context_line":"                        \u0027protocol to look up its corresponding mapping. \u0027"},{"line_number":909,"context_line":"                        \u0027It is the attribute name in the WSGI environment \u0027"},{"line_number":910,"context_line":"                        \u0027that references to the issuer of the client \u0027"},{"line_number":911,"context_line":"                        \u0027certificate.\u0027),"},{"line_number":912,"context_line":"    ],"}],"source_content_type":"text/x-python","patch_set":56,"id":"da20952f_124770bc","line":909,"updated":"2015-08-27 13:34:49.000000000","message":"attribute name or environment variable? \u0027as a IdP\u0027 or \u0027by an IdP\u0027?","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"019cbb1766bd174d043356f6de9920ffb207767e","unresolved":false,"context_lines":[{"line_number":906,"context_line":"                   help\u003d\u0027The issuer attribute that is served as a IdP for \u0027"},{"line_number":907,"context_line":"                        \u0027the X.509 tokenless authorization along with the \u0027"},{"line_number":908,"context_line":"                        \u0027protocol to look up its corresponding mapping. \u0027"},{"line_number":909,"context_line":"                        \u0027It is the attribute name in the WSGI environment \u0027"},{"line_number":910,"context_line":"                        \u0027that references to the issuer of the client \u0027"},{"line_number":911,"context_line":"                        \u0027certificate.\u0027),"},{"line_number":912,"context_line":"    ],"}],"source_content_type":"text/x-python","patch_set":56,"id":"da20952f_f6d17ece","line":909,"in_reply_to":"da20952f_124770bc","updated":"2015-08-27 18:19:47.000000000","message":"done.","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"}],"keystone/common/tokenless_auth.py":[{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6fd31068d72e8e36daf0271964ac2c546cdcd302","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Copyright 2012 OpenStack Foundation"},{"line_number":2,"context_line":"# Copyright 2010 United States Government as represented by the"},{"line_number":3,"context_line":"# Administrator of the National Aeronautics and Space Administration."},{"line_number":4,"context_line":"# Copyright 2011 - 2012 Justin Santa Barbara"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_a4f8344a","line":1,"updated":"2015-02-24 04:43:39.000000000","message":"This is a new file, shouldn\u0027t the copyrights be 2015?","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"3008f81dac993dbaf855035bfece9381e36b8ff5","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Copyright 2012 OpenStack Foundation"},{"line_number":2,"context_line":"# Copyright 2010 United States Government as represented by the"},{"line_number":3,"context_line":"# Administrator of the National Aeronautics and Space Administration."},{"line_number":4,"context_line":"# Copyright 2011 - 2012 Justin Santa Barbara"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_e7930e4d","line":1,"in_reply_to":"ba7be1f8_a4f8344a","updated":"2015-02-24 05:08:21.000000000","message":"# Copyright 2015 \u003cyour company name\u003e\n\ndelete the rest up until `All Right Reserved`\n\nKeep them if you actually used code that\u0027s been copyrighted, but AFAICT most of this is new\n\ntbh, i mostly just start it at \"All Rights Reserved\"","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2980c8fc4ec04546375fa362d53b2d238a90cebf","unresolved":false,"context_lines":[{"line_number":113,"context_line":"        rule_processor \u003d utils.RuleProcessor(rules)"},{"line_number":114,"context_line":"        mapped_properties \u003d rule_processor.process(env)"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"        user_id \u003d mapped_properties.get(\u0027user_id\u0027)"},{"line_number":117,"context_line":"        user_name \u003d mapped_properties.get(\u0027name\u0027)"},{"line_number":118,"context_line":"        user_domain_id \u003d mapped_properties.get(\u0027domain_id\u0027)"},{"line_number":119,"context_line":"        user_domain_name \u003d mapped_properties.get(\u0027domain_name\u0027)"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_f0ba22e0","line":116,"updated":"2015-02-21 05:04:37.000000000","message":"i think with marek\u0027s patch you might have to do some processing on mapped_properties here, but it should result in less code in the rule processor","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"fc1c53e4db3bc7ffae4618bc40ffaa0b1fb2621c","unresolved":false,"context_lines":[{"line_number":113,"context_line":"        rule_processor \u003d utils.RuleProcessor(rules)"},{"line_number":114,"context_line":"        mapped_properties \u003d rule_processor.process(env)"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"        user_id \u003d mapped_properties.get(\u0027user_id\u0027)"},{"line_number":117,"context_line":"        user_name \u003d mapped_properties.get(\u0027name\u0027)"},{"line_number":118,"context_line":"        user_domain_id \u003d mapped_properties.get(\u0027domain_id\u0027)"},{"line_number":119,"context_line":"        user_domain_name \u003d mapped_properties.get(\u0027domain_name\u0027)"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_ee2f7e9f","line":116,"in_reply_to":"ba7be1f8_f0ba22e0","updated":"2015-02-23 19:11:13.000000000","message":"will look at his patch.","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2980c8fc4ec04546375fa362d53b2d238a90cebf","unresolved":false,"context_lines":[{"line_number":151,"context_line":"        \"\"\""},{"line_number":152,"context_line":"        try:"},{"line_number":153,"context_line":"            idp \u003d env.get(CONF.auth.issuer_attri)"},{"line_number":154,"context_line":"        except KeyError:"},{"line_number":155,"context_line":"            msg \u003d _LW(\u0027Could not determine Identity Provider Id based on \u0027"},{"line_number":156,"context_line":"                      \u0027env attribute %(issuer_attri)s.\u0027)"},{"line_number":157,"context_line":"            six.reraise(exception.ValidationError(msg, {"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_70ce3285","line":154,"updated":"2015-02-21 05:04:37.000000000","message":"will this result in a KeyError? .get(blah) will result in None, not an error\n\n  \u003e\u003e\u003e dict1 \u003d {}\n  \u003e\u003e\u003e idp \u003d dict1.get(\u0027some_prop\u0027)\n  \u003e\u003e\u003e print idp\n  None\n  \u003e\u003e\u003e idp \u003d dict1[\u0027some_prop\u0027]\n  Traceback (most recent call last):\n    File \"\u003cstdin\u003e\", line 1, in \u003cmodule\u003e\n  KeyError: \u0027some_prop\u0027\n\nso either access env directly, or check `if not idp:`","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"7e05c24fcc95f788a0847b6fe749a2904559f419","unresolved":false,"context_lines":[{"line_number":151,"context_line":"        \"\"\""},{"line_number":152,"context_line":"        try:"},{"line_number":153,"context_line":"            idp \u003d env.get(CONF.auth.issuer_attri)"},{"line_number":154,"context_line":"        except KeyError:"},{"line_number":155,"context_line":"            msg \u003d _LW(\u0027Could not determine Identity Provider Id based on \u0027"},{"line_number":156,"context_line":"                      \u0027env attribute %(issuer_attri)s.\u0027)"},{"line_number":157,"context_line":"            six.reraise(exception.ValidationError(msg, {"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_f259ae8e","line":154,"in_reply_to":"ba7be1f8_70ce3285","updated":"2015-02-25 21:18:26.000000000","message":"good point!","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"7875b6a633f827cdbb3352606adfe0c15790b641","unresolved":false,"context_lines":[{"line_number":99,"context_line":"        :rtype: dict"},{"line_number":100,"context_line":"        \"\"\""},{"line_number":101,"context_line":"        idp_id \u003d self._build_idp_id(env)"},{"line_number":102,"context_line":"        LOG.debug(\u0027The IDP used for looking up the %s mapping is %s\u0027"},{"line_number":103,"context_line":"                  % (CONF.tokenless_auth.protocol, idp_id))"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"        mapping \u003d self.federation_api.get_mapping_from_idp_and_protocol("}],"source_content_type":"text/x-python","patch_set":12,"id":"9a80dd14_d0f0f2cb","line":102,"updated":"2015-03-04 07:24:12.000000000","message":"Parameters are reversed","commit_id":"550e15b5c613189d1eae6340f2d69dc5536dba64"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"c25c1222b90b277ffd47a0f39942b0c77ff0f46c","unresolved":false,"context_lines":[{"line_number":99,"context_line":"        :rtype: dict"},{"line_number":100,"context_line":"        \"\"\""},{"line_number":101,"context_line":"        idp_id \u003d self._build_idp_id(env)"},{"line_number":102,"context_line":"        LOG.debug(\u0027The IDP used for looking up the %s mapping is %s\u0027"},{"line_number":103,"context_line":"                  % (CONF.tokenless_auth.protocol, idp_id))"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"        mapping \u003d self.federation_api.get_mapping_from_idp_and_protocol("}],"source_content_type":"text/x-python","patch_set":12,"id":"9a80dd14_8cbc826e","line":102,"in_reply_to":"9a80dd14_d0f0f2cb","updated":"2015-03-04 22:53:41.000000000","message":"good catch, thx!","commit_id":"550e15b5c613189d1eae6340f2d69dc5536dba64"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8609e4e084b46909ce679e369816740b431ee371","unresolved":false,"context_lines":[{"line_number":113,"context_line":""},{"line_number":114,"context_line":"        user_id \u003d mapped_properties.get(\u0027user\u0027).get(\u0027user_id\u0027)"},{"line_number":115,"context_line":"        user_name \u003d mapped_properties.get(\u0027user\u0027).get(\u0027user_name\u0027)"},{"line_number":116,"context_line":"        user_domain_id \u003d mapped_properties.get(\u0027user\u0027).get(\u0027domain_id\u0027)"},{"line_number":117,"context_line":"        user_domain_name \u003d mapped_properties.get(\u0027user\u0027).get(\u0027domain_name\u0027)"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"        if user_id:"}],"source_content_type":"text/x-python","patch_set":12,"id":"9a80dd14_8a248bc7","line":116,"updated":"2015-03-04 06:38:22.000000000","message":"glad to see you could take advantage of marek\u0027s code!","commit_id":"550e15b5c613189d1eae6340f2d69dc5536dba64"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"c25c1222b90b277ffd47a0f39942b0c77ff0f46c","unresolved":false,"context_lines":[{"line_number":113,"context_line":""},{"line_number":114,"context_line":"        user_id \u003d mapped_properties.get(\u0027user\u0027).get(\u0027user_id\u0027)"},{"line_number":115,"context_line":"        user_name \u003d mapped_properties.get(\u0027user\u0027).get(\u0027user_name\u0027)"},{"line_number":116,"context_line":"        user_domain_id \u003d mapped_properties.get(\u0027user\u0027).get(\u0027domain_id\u0027)"},{"line_number":117,"context_line":"        user_domain_name \u003d mapped_properties.get(\u0027user\u0027).get(\u0027domain_name\u0027)"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"        if user_id:"}],"source_content_type":"text/x-python","patch_set":12,"id":"9a80dd14_6ca74e50","line":116,"in_reply_to":"9a80dd14_8a248bc7","updated":"2015-03-04 22:53:41.000000000","message":"marek\u0027s code does a good job on this ;-)","commit_id":"550e15b5c613189d1eae6340f2d69dc5536dba64"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"b5e1abb181363a4ae665762902c5f5f6601e2e2e","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"import base64"},{"line_number":17,"context_line":"import hashlib"},{"line_number":18,"context_line":"import six"},{"line_number":19,"context_line":"import sys"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"from oslo_log import log"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a80dd14_d418af86","line":18,"updated":"2015-03-05 07:56:34.000000000","message":"move six to 3rd party imports","commit_id":"7ac24a995cc44037e6c8e7003ee3b6d054eee0a5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"50fe1ed33aed6912e21cb82a369abebdc4346cf1","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"import base64"},{"line_number":17,"context_line":"import hashlib"},{"line_number":18,"context_line":"import six"},{"line_number":19,"context_line":"import sys"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"from oslo_log import log"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a80dd14_92fc8740","line":18,"in_reply_to":"9a80dd14_b2526bdb","updated":"2015-03-05 08:19:20.000000000","message":"i mean the 2nd grouping should look like:\n\n  from oslo_log import log\n  from oslo_serialization import jsonutils\n  import six\n\nthe overall order of imports should be split into 3 groups, separated by blank lines\n\n  \u003cstandard lib\u003e\n\n  \u003cthird party lib\u003e\n\n  \u003clocal resources\u003e","commit_id":"7ac24a995cc44037e6c8e7003ee3b6d054eee0a5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"ff0c835f3f0362d1e610e584a93064d49c7a05b9","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"import base64"},{"line_number":17,"context_line":"import hashlib"},{"line_number":18,"context_line":"import six"},{"line_number":19,"context_line":"import sys"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"from oslo_log import log"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a80dd14_b2526bdb","line":18,"in_reply_to":"9a80dd14_d418af86","updated":"2015-03-05 08:12:29.000000000","message":"Not sure where is the third party imports?","commit_id":"7ac24a995cc44037e6c8e7003ee3b6d054eee0a5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"b5e1abb181363a4ae665762902c5f5f6601e2e2e","unresolved":false,"context_lines":[{"line_number":137,"context_line":"        return user_ref"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"    def _build_idp_id(self, env):"},{"line_number":140,"context_line":"        \"\"\"Build the IDP name from the given config option issuer_attribute,"},{"line_number":141,"context_line":"        by default SSL_CLIENT_I_DN in the environment with"},{"line_number":142,"context_line":"        the following formula -"},{"line_number":143,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"9a80dd14_f49a1313","line":140,"updated":"2015-03-05 07:56:34.000000000","message":"try to create docstrings in the following format:\n\n  \"\"\"one line summary.\n\n  additional notes that should span\n  multiple lines\n  \"\"\"\n\nit\u0027s summarized here: https://www.python.org/dev/peps/pep-0257/#multi-line-docstrings","commit_id":"7ac24a995cc44037e6c8e7003ee3b6d054eee0a5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"ff0c835f3f0362d1e610e584a93064d49c7a05b9","unresolved":false,"context_lines":[{"line_number":137,"context_line":"        return user_ref"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"    def _build_idp_id(self, env):"},{"line_number":140,"context_line":"        \"\"\"Build the IDP name from the given config option issuer_attribute,"},{"line_number":141,"context_line":"        by default SSL_CLIENT_I_DN in the environment with"},{"line_number":142,"context_line":"        the following formula -"},{"line_number":143,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"9a80dd14_b2698b8d","line":140,"in_reply_to":"9a80dd14_f49a1313","updated":"2015-03-05 08:12:29.000000000","message":"Got that.","commit_id":"7ac24a995cc44037e6c8e7003ee3b6d054eee0a5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"b5e1abb181363a4ae665762902c5f5f6601e2e2e","unresolved":false,"context_lines":[{"line_number":143,"context_line":""},{"line_number":144,"context_line":"        base64_idp \u003d base64(sha1(env[\u0027SSL_CLIENT_I_DN\u0027]))"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"        :param env: The environment"},{"line_number":147,"context_line":"        :returns: base64_idp like the above example"},{"line_number":148,"context_line":"        :rtype: str"},{"line_number":149,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":13,"id":"9a80dd14_b47edbac","line":146,"updated":"2015-03-05 07:56:34.000000000","message":"call it \u0027HTTP request environment\u0027","commit_id":"7ac24a995cc44037e6c8e7003ee3b6d054eee0a5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"b5e1abb181363a4ae665762902c5f5f6601e2e2e","unresolved":false,"context_lines":[{"line_number":157,"context_line":"        hashed_idp \u003d hashlib.sha256(idp)"},{"line_number":158,"context_line":"        return base64.b64encode(hashed_idp.digest())"},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"    def assert_user_is_enabled(self, user_ref):"},{"line_number":161,"context_line":"        try:"},{"line_number":162,"context_line":"            self.identity_api.assert_user_enabled("},{"line_number":163,"context_line":"                user_id\u003duser_ref[\u0027id\u0027],"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a80dd14_745b8354","line":160,"updated":"2015-03-05 07:56:34.000000000","message":"prefix this function with _ to indicate that it\u0027s private","commit_id":"7ac24a995cc44037e6c8e7003ee3b6d054eee0a5"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"2aa069144e5a41481bd62d675e0efa48e0a737e4","unresolved":false,"context_lines":[{"line_number":89,"context_line":"        return auth_info.get_scope()"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"    def get_mapped_user(self, env):"},{"line_number":92,"context_line":"        \"\"\"Map X.509 client cert to an existing user."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"        :param env: The HTTP requestenvironment that should contains"},{"line_number":95,"context_line":"            client certificate attributes, such as"}],"source_content_type":"text/x-python","patch_set":21,"id":"baa041b7_bcc43a40","line":92,"updated":"2015-04-02 12:52:41.000000000","message":"This should be wider applicability than just X509.  \"Map user from assertion attribute\"","commit_id":"965ba1ea6cb25d1b6fd4620c2e17266c318a6fec"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"2aa069144e5a41481bd62d675e0efa48e0a737e4","unresolved":false,"context_lines":[{"line_number":115,"context_line":"        user_name \u003d mapped_properties.get(\u0027user\u0027).get(\u0027user_name\u0027)"},{"line_number":116,"context_line":"        user_domain_id \u003d mapped_properties.get(\u0027user\u0027).get(\u0027domain_id\u0027)"},{"line_number":117,"context_line":"        user_domain_name \u003d mapped_properties.get(\u0027user\u0027).get(\u0027domain_name\u0027)"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"        if user_id:"},{"line_number":120,"context_line":"            user_ref \u003d self.identity_api.get_user(user_id)"},{"line_number":121,"context_line":"        elif user_name and (user_domain_name or user_domain_id):"}],"source_content_type":"text/x-python","patch_set":21,"id":"baa041b7_9cef36b0","line":118,"updated":"2015-04-02 12:52:41.000000000","message":"We should also grab any mapped groups.  Basically, treat this like a Federated token if possible.","commit_id":"965ba1ea6cb25d1b6fd4620c2e17266c318a6fec"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"386ffe0cf56283202adfa9151e6d2ac07a6f7662","unresolved":false,"context_lines":[{"line_number":115,"context_line":"        user_name \u003d mapped_properties.get(\u0027user\u0027).get(\u0027user_name\u0027)"},{"line_number":116,"context_line":"        user_domain_id \u003d mapped_properties.get(\u0027user\u0027).get(\u0027domain_id\u0027)"},{"line_number":117,"context_line":"        user_domain_name \u003d mapped_properties.get(\u0027user\u0027).get(\u0027domain_name\u0027)"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"        if user_id:"},{"line_number":120,"context_line":"            user_ref \u003d self.identity_api.get_user(user_id)"},{"line_number":121,"context_line":"        elif user_name and (user_domain_name or user_domain_id):"}],"source_content_type":"text/x-python","patch_set":21,"id":"baa041b7_2ebb1729","line":118,"in_reply_to":"baa041b7_9cef36b0","updated":"2015-04-03 22:46:20.000000000","message":"This is actually different from the federated user, the scope for the federated user will be based on what the group is assigned that the user maps to, that\u0027s why the federated needs the group.\nIn this implementation, it only cares if this user exits and validates the scope it passes in through the header. And the group info is irrelevant here.","commit_id":"965ba1ea6cb25d1b6fd4620c2e17266c318a6fec"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":28,"context_line":"from keystone import exception"},{"line_number":29,"context_line":"from keystone.i18n import _LW"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"CONF \u003d config.CONF"},{"line_number":32,"context_line":"LOG \u003d log.getLogger(__name__)"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_4851c40d","line":31,"updated":"2015-05-01 15:51:04.000000000","message":"get config frop oslo_config.cfg rather than keystone.common.config.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":28,"context_line":"from keystone import exception"},{"line_number":29,"context_line":"from keystone.i18n import _LW"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"CONF \u003d config.CONF"},{"line_number":32,"context_line":"LOG \u003d log.getLogger(__name__)"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_b4e0aefb","line":31,"in_reply_to":"3acd31a7_4851c40d","updated":"2015-05-01 21:28:34.000000000","message":"sure.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":80,"context_line":"        # NOTE(chioleong): auth methods here is insignificant because"},{"line_number":81,"context_line":"        # we only care about using auth.controllers.AuthInfo"},{"line_number":82,"context_line":"        # to validate the scope information"},{"line_number":83,"context_line":"        auth[\u0027identity\u0027][\u0027methods\u0027] \u003d [\u0027token\u0027]"},{"line_number":84,"context_line":"        auth[\u0027identity\u0027][\u0027token\u0027] \u003d {}"},{"line_number":85,"context_line":"        auth[\u0027scope\u0027] \u003d self._build_scope_info(env)"},{"line_number":86,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_28a68810","line":83,"updated":"2015-05-01 15:51:04.000000000","message":"Let\u0027s fix the code so that we don\u0027t need to do this then.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":80,"context_line":"        # NOTE(chioleong): auth methods here is insignificant because"},{"line_number":81,"context_line":"        # we only care about using auth.controllers.AuthInfo"},{"line_number":82,"context_line":"        # to validate the scope information"},{"line_number":83,"context_line":"        auth[\u0027identity\u0027][\u0027methods\u0027] \u003d [\u0027token\u0027]"},{"line_number":84,"context_line":"        auth[\u0027identity\u0027][\u0027token\u0027] \u003d {}"},{"line_number":85,"context_line":"        auth[\u0027scope\u0027] \u003d self._build_scope_info(env)"},{"line_number":86,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_d4820a00","line":83,"in_reply_to":"3acd31a7_28a68810","updated":"2015-05-01 21:28:34.000000000","message":"yeah, that\u0027s better idea.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":91,"context_line":"    def get_mapped_user(self, env):"},{"line_number":92,"context_line":"        \"\"\"Map client certificate to an existing user."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"        :param env: The HTTP request environment that should contains"},{"line_number":95,"context_line":"            client certificate attributes, such as"},{"line_number":96,"context_line":"            SSL_CLIENT_S_DN_CN, SSL_CLIENT_I_DN_O"},{"line_number":97,"context_line":"        :returns: A dictionary that contains the keys, such as"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_c8ab94d5","line":94,"updated":"2015-05-01 15:51:04.000000000","message":"change \"contains\" to \"contain\"\n\nThis says it \"should\", but what if it doesn\u0027t?","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":91,"context_line":"    def get_mapped_user(self, env):"},{"line_number":92,"context_line":"        \"\"\"Map client certificate to an existing user."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"        :param env: The HTTP request environment that should contains"},{"line_number":95,"context_line":"            client certificate attributes, such as"},{"line_number":96,"context_line":"            SSL_CLIENT_S_DN_CN, SSL_CLIENT_I_DN_O"},{"line_number":97,"context_line":"        :returns: A dictionary that contains the keys, such as"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_34d7feee","line":94,"in_reply_to":"3acd31a7_c8ab94d5","updated":"2015-05-01 21:28:34.000000000","message":"if ssl is used, those attributes should always be there. If not, user will not be mapped and causes un-authenticated. \nAnd I will put that down.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":104,"context_line":""},{"line_number":105,"context_line":"        mapping \u003d self.federation_api.get_mapping_from_idp_and_protocol("},{"line_number":106,"context_line":"            idp_id, CONF.tokenless_auth.protocol)"},{"line_number":107,"context_line":"        rules \u003d jsonutils.loads(mapping[\u0027rules\u0027])"},{"line_number":108,"context_line":"        LOG.debug(\u0027Tokenless authentication uses the following rules: %s\u0027,"},{"line_number":109,"context_line":"                  rules)"},{"line_number":110,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_28f448f0","line":107,"updated":"2015-05-01 15:51:04.000000000","message":"mapping is json rather than a dict already? this seems wrong.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":104,"context_line":""},{"line_number":105,"context_line":"        mapping \u003d self.federation_api.get_mapping_from_idp_and_protocol("},{"line_number":106,"context_line":"            idp_id, CONF.tokenless_auth.protocol)"},{"line_number":107,"context_line":"        rules \u003d jsonutils.loads(mapping[\u0027rules\u0027])"},{"line_number":108,"context_line":"        LOG.debug(\u0027Tokenless authentication uses the following rules: %s\u0027,"},{"line_number":109,"context_line":"                  rules)"},{"line_number":110,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_d40c4a96","line":107,"in_reply_to":"3acd31a7_28f448f0","updated":"2015-05-01 21:28:34.000000000","message":"doubl-checked. no, it\u0027s a dict.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":106,"context_line":"            idp_id, CONF.tokenless_auth.protocol)"},{"line_number":107,"context_line":"        rules \u003d jsonutils.loads(mapping[\u0027rules\u0027])"},{"line_number":108,"context_line":"        LOG.debug(\u0027Tokenless authentication uses the following rules: %s\u0027,"},{"line_number":109,"context_line":"                  rules)"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"        rule_processor \u003d utils.RuleProcessor(rules)"},{"line_number":112,"context_line":"        mapped_properties \u003d rule_processor.process(env)"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_c8d95485","line":109,"updated":"2015-05-01 15:51:04.000000000","message":"This debug seems excessive.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":106,"context_line":"            idp_id, CONF.tokenless_auth.protocol)"},{"line_number":107,"context_line":"        rules \u003d jsonutils.loads(mapping[\u0027rules\u0027])"},{"line_number":108,"context_line":"        LOG.debug(\u0027Tokenless authentication uses the following rules: %s\u0027,"},{"line_number":109,"context_line":"                  rules)"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"        rule_processor \u003d utils.RuleProcessor(rules)"},{"line_number":112,"context_line":"        mapped_properties \u003d rule_processor.process(env)"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_14c88221","line":109,"in_reply_to":"3acd31a7_c8d95485","updated":"2015-05-01 21:28:34.000000000","message":"this exactly helped me a lot when I had incorrect rules defined. I probably will keep it unless there is a strong objection ;-).","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":108,"context_line":"        LOG.debug(\u0027Tokenless authentication uses the following rules: %s\u0027,"},{"line_number":109,"context_line":"                  rules)"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"        rule_processor \u003d utils.RuleProcessor(rules)"},{"line_number":112,"context_line":"        mapped_properties \u003d rule_processor.process(env)"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"        user_id \u003d mapped_properties.get(\u0027user\u0027).get(\u0027user_id\u0027)"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_08ce2cb4","line":111,"updated":"2015-05-01 15:51:04.000000000","message":"why are we having to do this? shouldn\u0027t the federation api be able to do this for us?","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":108,"context_line":"        LOG.debug(\u0027Tokenless authentication uses the following rules: %s\u0027,"},{"line_number":109,"context_line":"                  rules)"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"        rule_processor \u003d utils.RuleProcessor(rules)"},{"line_number":112,"context_line":"        mapped_properties \u003d rule_processor.process(env)"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"        user_id \u003d mapped_properties.get(\u0027user\u0027).get(\u0027user_id\u0027)"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_f498661d","line":111,"in_reply_to":"3acd31a7_08ce2cb4","updated":"2015-05-01 21:28:34.000000000","message":"that\u0027s the current way to initialize the RuleProcessor","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":111,"context_line":"        rule_processor \u003d utils.RuleProcessor(rules)"},{"line_number":112,"context_line":"        mapped_properties \u003d rule_processor.process(env)"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"        user_id \u003d mapped_properties.get(\u0027user\u0027).get(\u0027user_id\u0027)"},{"line_number":115,"context_line":"        user_name \u003d mapped_properties.get(\u0027user\u0027).get(\u0027user_name\u0027)"},{"line_number":116,"context_line":"        user_domain_id \u003d mapped_properties.get(\u0027user\u0027).get(\u0027domain_id\u0027)"},{"line_number":117,"context_line":"        user_domain_name \u003d mapped_properties.get(\u0027user\u0027).get(\u0027domain_name\u0027)"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_28420811","line":114,"updated":"2015-05-01 15:51:04.000000000","message":".get(\u0027user\u0027) might return None, in which case the next call to .get is just going to fail.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":111,"context_line":"        rule_processor \u003d utils.RuleProcessor(rules)"},{"line_number":112,"context_line":"        mapped_properties \u003d rule_processor.process(env)"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"        user_id \u003d mapped_properties.get(\u0027user\u0027).get(\u0027user_id\u0027)"},{"line_number":115,"context_line":"        user_name \u003d mapped_properties.get(\u0027user\u0027).get(\u0027user_name\u0027)"},{"line_number":116,"context_line":"        user_domain_id \u003d mapped_properties.get(\u0027user\u0027).get(\u0027domain_id\u0027)"},{"line_number":117,"context_line":"        user_domain_name \u003d mapped_properties.get(\u0027user\u0027).get(\u0027domain_name\u0027)"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_947812c6","line":114,"in_reply_to":"3acd31a7_28420811","updated":"2015-05-01 21:28:34.000000000","message":"sure. I can set a validation there.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":132,"context_line":"                      \u0027provided input: user Id is None or \u0027"},{"line_number":133,"context_line":"                      \u0027(user_name and domain_id) \u0027"},{"line_number":134,"context_line":"                      \u0027is None or (user_name and domain_name) is None\u0027)"},{"line_number":135,"context_line":"            raise exception.ValidationError(msg)"},{"line_number":136,"context_line":"        self._assert_user_is_enabled(user_ref)"},{"line_number":137,"context_line":"        return user_ref"},{"line_number":138,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_6806c0cf","line":135,"updated":"2015-05-01 15:51:04.000000000","message":"Is it safe to send this message back to the client?","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":132,"context_line":"                      \u0027provided input: user Id is None or \u0027"},{"line_number":133,"context_line":"                      \u0027(user_name and domain_id) \u0027"},{"line_number":134,"context_line":"                      \u0027is None or (user_name and domain_name) is None\u0027)"},{"line_number":135,"context_line":"            raise exception.ValidationError(msg)"},{"line_number":136,"context_line":"        self._assert_user_is_enabled(user_ref)"},{"line_number":137,"context_line":"        return user_ref"},{"line_number":138,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_342b7e96","line":135,"in_reply_to":"3acd31a7_6806c0cf","updated":"2015-05-01 21:28:34.000000000","message":"it seems to be alright to me .. I will make sure there is a test case to cover this.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":152,"context_line":"        if idp is None:"},{"line_number":153,"context_line":"            msg \u003d _LW(\u0027Could not determine Identity Provider Id based on \u0027"},{"line_number":154,"context_line":"                      \u0027env attribute %(issuer_attribute)s.\u0027)"},{"line_number":155,"context_line":"            raise exception.ValidationError(msg, {"},{"line_number":156,"context_line":"                \u0027issuer_attribute\u0027: CONF.auth.issuer_attri})"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"        hashed_idp \u003d hashlib.sha256(idp)"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_2827a865","line":155,"updated":"2015-05-01 15:51:04.000000000","message":"Is this a validation error or a config error?","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":152,"context_line":"        if idp is None:"},{"line_number":153,"context_line":"            msg \u003d _LW(\u0027Could not determine Identity Provider Id based on \u0027"},{"line_number":154,"context_line":"                      \u0027env attribute %(issuer_attribute)s.\u0027)"},{"line_number":155,"context_line":"            raise exception.ValidationError(msg, {"},{"line_number":156,"context_line":"                \u0027issuer_attribute\u0027: CONF.auth.issuer_attri})"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"        hashed_idp \u003d hashlib.sha256(idp)"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_b4154e4a","line":155,"in_reply_to":"3acd31a7_2827a865","updated":"2015-05-01 21:28:34.000000000","message":"right, config error seems to be better ;-)","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":160,"context_line":""},{"line_number":161,"context_line":"    def _assert_user_is_enabled(self, user_ref):"},{"line_number":162,"context_line":"        try:"},{"line_number":163,"context_line":"            self.identity_api.assert_user_enabled("},{"line_number":164,"context_line":"                user_id\u003duser_ref[\u0027id\u0027],"},{"line_number":165,"context_line":"                user\u003duser_ref)"},{"line_number":166,"context_line":"        except AssertionError as e:"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_48d78423","line":163,"updated":"2015-05-01 15:51:04.000000000","message":"seems like we should be able to call get_user_by_name and pass an option that requires that the user is enabled.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":160,"context_line":""},{"line_number":161,"context_line":"    def _assert_user_is_enabled(self, user_ref):"},{"line_number":162,"context_line":"        try:"},{"line_number":163,"context_line":"            self.identity_api.assert_user_enabled("},{"line_number":164,"context_line":"                user_id\u003duser_ref[\u0027id\u0027],"},{"line_number":165,"context_line":"                user\u003duser_ref)"},{"line_number":166,"context_line":"        except AssertionError as e:"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_b75af028","line":163,"in_reply_to":"3acd31a7_48d78423","updated":"2015-05-01 21:28:34.000000000","message":"no, that\u0027s the signature -\ndef get_user_by_name(self, user_name, domain_id)","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":34,"context_line":""},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"@dependency.requires(\u0027federation_api\u0027, \u0027identity_api\u0027,"},{"line_number":37,"context_line":"                     \u0027assignment_api\u0027, \u0027resource_api\u0027)"},{"line_number":38,"context_line":"class TokenlessAuthHelper(object):"},{"line_number":39,"context_line":"    def _build_scope_info(self, env):"},{"line_number":40,"context_line":"        \"\"\"Build the token request scope based on the headers."}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_0fae5785","line":37,"updated":"2015-05-13 02:18:51.000000000","message":"keep the list in alphabetical order.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":80,"context_line":"        auth \u003d {}"},{"line_number":81,"context_line":"        # NOTE(chioleong): auth methods here is insignificant because"},{"line_number":82,"context_line":"        # we only care about using auth.controllers.AuthInfo"},{"line_number":83,"context_line":"        # to validate the scope information. Thereofre,"},{"line_number":84,"context_line":"        # we don\u0027t provide any identity here."},{"line_number":85,"context_line":"        auth[\u0027scope\u0027] \u003d self._build_scope_info(env)"},{"line_number":86,"context_line":""}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_6fb5d3cb","line":83,"updated":"2015-05-13 02:18:51.000000000","message":"change \"Thereofre\" to \"Therefore\"","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":94,"context_line":""},{"line_number":95,"context_line":"        :param env: The HTTP request environment that should contain"},{"line_number":96,"context_line":"            client certificate attributes. These attributes should match"},{"line_number":97,"context_line":"            with what the mapping defines. Or an user cannot be mapped and"},{"line_number":98,"context_line":"            results un-authenticated. For example:"},{"line_number":99,"context_line":"            SSL_CLIENT_S_DN_CN, SSL_CLIENT_I_DN_O"},{"line_number":100,"context_line":"        :param project_id:  Project Id."}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_af098b97","line":97,"updated":"2015-05-13 02:18:51.000000000","message":"change \"an user\" to \"a user\"","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"81c2a0ff6a7e227a15f04d967f50f240ebc82aa4","unresolved":false,"context_lines":[{"line_number":94,"context_line":""},{"line_number":95,"context_line":"        :param env: The HTTP request environment that should contain"},{"line_number":96,"context_line":"            client certificate attributes. These attributes should match"},{"line_number":97,"context_line":"            with what the mapping defines. Or an user cannot be mapped and"},{"line_number":98,"context_line":"            results un-authenticated. For example:"},{"line_number":99,"context_line":"            SSL_CLIENT_S_DN_CN, SSL_CLIENT_I_DN_O"},{"line_number":100,"context_line":"        :param project_id:  Project Id."}],"source_content_type":"text/x-python","patch_set":26,"id":"7a016987_9f35c4db","line":97,"in_reply_to":"7a016987_b94b27b0","updated":"2015-05-15 17:45:51.000000000","message":"yeah, fair enough.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"5d690a39bd5f5e5a84a69cc5d1d17207f054190e","unresolved":false,"context_lines":[{"line_number":94,"context_line":""},{"line_number":95,"context_line":"        :param env: The HTTP request environment that should contain"},{"line_number":96,"context_line":"            client certificate attributes. These attributes should match"},{"line_number":97,"context_line":"            with what the mapping defines. Or an user cannot be mapped and"},{"line_number":98,"context_line":"            results un-authenticated. For example:"},{"line_number":99,"context_line":"            SSL_CLIENT_S_DN_CN, SSL_CLIENT_I_DN_O"},{"line_number":100,"context_line":"        :param project_id:  Project Id."}],"source_content_type":"text/x-python","patch_set":26,"id":"7a016987_b94b27b0","line":97,"in_reply_to":"9a0c5dc1_4f30a601","updated":"2015-05-14 18:55:35.000000000","message":"http://git.openstack.org/cgit/openstack/openstack-manuals/tree/doc/common/section_keystone-concepts-user-management.xml#n13 -- OpenStack convention is to use \"a user\". I haven\u0027t seen any examples using \"an user\".","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"7e506bafe89392ced44a8aafe46be1e6d47dfe68","unresolved":false,"context_lines":[{"line_number":94,"context_line":""},{"line_number":95,"context_line":"        :param env: The HTTP request environment that should contain"},{"line_number":96,"context_line":"            client certificate attributes. These attributes should match"},{"line_number":97,"context_line":"            with what the mapping defines. Or an user cannot be mapped and"},{"line_number":98,"context_line":"            results un-authenticated. For example:"},{"line_number":99,"context_line":"            SSL_CLIENT_S_DN_CN, SSL_CLIENT_I_DN_O"},{"line_number":100,"context_line":"        :param project_id:  Project Id."}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_4f30a601","line":97,"in_reply_to":"9a0c5dc1_af098b97","updated":"2015-05-14 00:14:45.000000000","message":"I think it should be an ? :)","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":96,"context_line":"            client certificate attributes. These attributes should match"},{"line_number":97,"context_line":"            with what the mapping defines. Or an user cannot be mapped and"},{"line_number":98,"context_line":"            results un-authenticated. For example:"},{"line_number":99,"context_line":"            SSL_CLIENT_S_DN_CN, SSL_CLIENT_I_DN_O"},{"line_number":100,"context_line":"        :param project_id:  Project Id."},{"line_number":101,"context_line":"        :param domain_id: Domain Id."},{"line_number":102,"context_line":"        :param ephemeral_user: Defaults to False."}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_6f039374","line":99,"updated":"2015-05-13 02:18:51.000000000","message":"what is this an example of?","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":97,"context_line":"            with what the mapping defines. Or an user cannot be mapped and"},{"line_number":98,"context_line":"            results un-authenticated. For example:"},{"line_number":99,"context_line":"            SSL_CLIENT_S_DN_CN, SSL_CLIENT_I_DN_O"},{"line_number":100,"context_line":"        :param project_id:  Project Id."},{"line_number":101,"context_line":"        :param domain_id: Domain Id."},{"line_number":102,"context_line":"        :param ephemeral_user: Defaults to False."},{"line_number":103,"context_line":"        :returns: A dictionary that contains the keys, such as"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_6fecb3c7","line":100,"updated":"2015-05-13 02:18:51.000000000","message":"what project is this supposed to be?","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":98,"context_line":"            results un-authenticated. For example:"},{"line_number":99,"context_line":"            SSL_CLIENT_S_DN_CN, SSL_CLIENT_I_DN_O"},{"line_number":100,"context_line":"        :param project_id:  Project Id."},{"line_number":101,"context_line":"        :param domain_id: Domain Id."},{"line_number":102,"context_line":"        :param ephemeral_user: Defaults to False."},{"line_number":103,"context_line":"        :returns: A dictionary that contains the keys, such as"},{"line_number":104,"context_line":"            user_id, user_name, domain_id, domain_name"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_4fd20f02","line":101,"updated":"2015-05-13 02:18:51.000000000","message":"domain for what?","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":99,"context_line":"            SSL_CLIENT_S_DN_CN, SSL_CLIENT_I_DN_O"},{"line_number":100,"context_line":"        :param project_id:  Project Id."},{"line_number":101,"context_line":"        :param domain_id: Domain Id."},{"line_number":102,"context_line":"        :param ephemeral_user: Defaults to False."},{"line_number":103,"context_line":"        :returns: A dictionary that contains the keys, such as"},{"line_number":104,"context_line":"            user_id, user_name, domain_id, domain_name"},{"line_number":105,"context_line":"        :rtype: dict"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_0fdc1711","line":102,"updated":"2015-05-13 02:18:51.000000000","message":"the docs should say what the paremeter is used for.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":117,"context_line":""},{"line_number":118,"context_line":"        user \u003d mapped_properties.get(\u0027user\u0027)"},{"line_number":119,"context_line":"        if user is None:"},{"line_number":120,"context_line":"            user_id \u003d None"},{"line_number":121,"context_line":"            user_name \u003d None"},{"line_number":122,"context_line":"            user_domain_id \u003d None"},{"line_number":123,"context_line":"            user_domain_name \u003d None"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_ef4663be","line":120,"updated":"2015-05-13 02:18:51.000000000","message":"if line 118 was changed to .get(\u0027user\u0027, {}) then this wouldn\u0027t be needed.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"7e506bafe89392ced44a8aafe46be1e6d47dfe68","unresolved":false,"context_lines":[{"line_number":117,"context_line":""},{"line_number":118,"context_line":"        user \u003d mapped_properties.get(\u0027user\u0027)"},{"line_number":119,"context_line":"        if user is None:"},{"line_number":120,"context_line":"            user_id \u003d None"},{"line_number":121,"context_line":"            user_name \u003d None"},{"line_number":122,"context_line":"            user_domain_id \u003d None"},{"line_number":123,"context_line":"            user_domain_name \u003d None"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_abc035e1","line":120,"in_reply_to":"9a0c5dc1_ef4663be","updated":"2015-05-14 00:14:45.000000000","message":"yep, that\u0027s cleaner.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"5d690a39bd5f5e5a84a69cc5d1d17207f054190e","unresolved":false,"context_lines":[{"line_number":182,"context_line":"        \"\"\""},{"line_number":183,"context_line":"        idp \u003d env.get(CONF.tokenless_auth.issuer_attribute)"},{"line_number":184,"context_line":"        if idp is None:"},{"line_number":185,"context_line":"            msg \u003d _LW(\u0027Could not determine Identity Provider Id based on \u0027"},{"line_number":186,"context_line":"                      \u0027env attribute %(issuer_attribute)s.\u0027)"},{"line_number":187,"context_line":"            raise exception.ConfigurationError(msg, {"},{"line_number":188,"context_line":"                \u0027issuer_attribute\u0027: CONF.auth.issuer_attri})"}],"source_content_type":"text/x-python","patch_set":26,"id":"7a016987_d9c4a341","line":185,"updated":"2015-05-14 18:55:35.000000000","message":"this is used in an exception and not to LOG.warning(), so change _LW() to _().","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":184,"context_line":"        if idp is None:"},{"line_number":185,"context_line":"            msg \u003d _LW(\u0027Could not determine Identity Provider Id based on \u0027"},{"line_number":186,"context_line":"                      \u0027env attribute %(issuer_attribute)s.\u0027)"},{"line_number":187,"context_line":"            raise exception.ConfigurationError(msg, {"},{"line_number":188,"context_line":"                \u0027issuer_attribute\u0027: CONF.auth.issuer_attri})"},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"        hashed_idp \u003d hashlib.sha256(idp)"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_cfc71f11","line":187,"updated":"2015-05-13 02:18:51.000000000","message":"use % rather than ,","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":185,"context_line":"            msg \u003d _LW(\u0027Could not determine Identity Provider Id based on \u0027"},{"line_number":186,"context_line":"                      \u0027env attribute %(issuer_attribute)s.\u0027)"},{"line_number":187,"context_line":"            raise exception.ConfigurationError(msg, {"},{"line_number":188,"context_line":"                \u0027issuer_attribute\u0027: CONF.auth.issuer_attri})"},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"        hashed_idp \u003d hashlib.sha256(idp)"},{"line_number":191,"context_line":"        return base64.b64encode(hashed_idp.digest())"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_ef4b03af","line":188,"updated":"2015-05-13 02:18:51.000000000","message":"issuer_attri ? this needs a test.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"7e506bafe89392ced44a8aafe46be1e6d47dfe68","unresolved":false,"context_lines":[{"line_number":185,"context_line":"            msg \u003d _LW(\u0027Could not determine Identity Provider Id based on \u0027"},{"line_number":186,"context_line":"                      \u0027env attribute %(issuer_attribute)s.\u0027)"},{"line_number":187,"context_line":"            raise exception.ConfigurationError(msg, {"},{"line_number":188,"context_line":"                \u0027issuer_attribute\u0027: CONF.auth.issuer_attri})"},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"        hashed_idp \u003d hashlib.sha256(idp)"},{"line_number":191,"context_line":"        return base64.b64encode(hashed_idp.digest())"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_6bba3d70","line":188,"in_reply_to":"9a0c5dc1_ef4b03af","updated":"2015-05-14 00:14:45.000000000","message":"I should.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"a2cab849c5e8441c44c399393084b3484b548c58","unresolved":false,"context_lines":[{"line_number":27,"context_line":"from keystone.contrib.federation import utils"},{"line_number":28,"context_line":"from keystone import exception"},{"line_number":29,"context_line":"from keystone.i18n import _, _LW"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"CONF \u003d cfg.CONF"},{"line_number":32,"context_line":"LOG \u003d log.getLogger(__name__)"},{"line_number":33,"context_line":""}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_7f0a9d8b","line":30,"updated":"2015-07-15 19:57:47.000000000","message":"(nit) newline","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"a2cab849c5e8441c44c399393084b3484b548c58","unresolved":false,"context_lines":[{"line_number":50,"context_line":"        domain_name \u003d env.get(\u0027HTTP_X_DOMAIN_NAME\u0027)"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"        scope \u003d {}"},{"line_number":53,"context_line":"        if project_id or project_name:"},{"line_number":54,"context_line":"            if project_id:"},{"line_number":55,"context_line":"                scope[\u0027project\u0027] \u003d {\u0027id\u0027: project_id}"},{"line_number":56,"context_line":"            else:"}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_4d6133a8","line":53,"updated":"2015-07-15 19:57:47.000000000","message":"A later refactoring may be to unnest these nested \u0027if\u0027 statements.","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"8ada87ee5b062ac22c3cd494fd285e3982f06c4e","unresolved":false,"context_lines":[{"line_number":50,"context_line":"        domain_name \u003d env.get(\u0027HTTP_X_DOMAIN_NAME\u0027)"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"        scope \u003d {}"},{"line_number":53,"context_line":"        if project_id or project_name:"},{"line_number":54,"context_line":"            if project_id:"},{"line_number":55,"context_line":"                scope[\u0027project\u0027] \u003d {\u0027id\u0027: project_id}"},{"line_number":56,"context_line":"            else:"}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_aeb3154c","line":53,"in_reply_to":"9a41bdd9_4d6133a8","updated":"2015-07-16 02:50:56.000000000","message":"done","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"a2cab849c5e8441c44c399393084b3484b548c58","unresolved":false,"context_lines":[{"line_number":60,"context_line":"                elif project_domain_name:"},{"line_number":61,"context_line":"                    scope[\u0027project\u0027][\u0027domain\u0027] \u003d {\u0027name\u0027: project_domain_name}"},{"line_number":62,"context_line":"                else:"},{"line_number":63,"context_line":"                    msg \u003d _LW(\u0027Project-domain Id or Project-domain name \u0027"},{"line_number":64,"context_line":"                              \u0027is not provided.\u0027)"},{"line_number":65,"context_line":"                    raise exception.ValidationError(msg)"},{"line_number":66,"context_line":"        elif domain_id or domain_name:"}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_adc23f51","line":63,"updated":"2015-07-15 19:57:47.000000000","message":"Why is this _LW? It should be _","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"8ada87ee5b062ac22c3cd494fd285e3982f06c4e","unresolved":false,"context_lines":[{"line_number":60,"context_line":"                elif project_domain_name:"},{"line_number":61,"context_line":"                    scope[\u0027project\u0027][\u0027domain\u0027] \u003d {\u0027name\u0027: project_domain_name}"},{"line_number":62,"context_line":"                else:"},{"line_number":63,"context_line":"                    msg \u003d _LW(\u0027Project-domain Id or Project-domain name \u0027"},{"line_number":64,"context_line":"                              \u0027is not provided.\u0027)"},{"line_number":65,"context_line":"                    raise exception.ValidationError(msg)"},{"line_number":66,"context_line":"        elif domain_id or domain_name:"}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_ceb2194c","line":63,"in_reply_to":"9a41bdd9_adc23f51","updated":"2015-07-16 02:50:56.000000000","message":"done","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"a2cab849c5e8441c44c399393084b3484b548c58","unresolved":false,"context_lines":[{"line_number":111,"context_line":"        \"\"\""},{"line_number":112,"context_line":"        idp_id \u003d self._build_idp_id(env)"},{"line_number":113,"context_line":"        LOG.debug(\u0027The IdP Id %s and protocol Id %s are used to look up \u0027"},{"line_number":114,"context_line":"                  \u0027the mapping.\u0027 % (idp_id, CONF.tokenless_auth.protocol))"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"        mapping \u003d self.federation_api.get_mapping_from_idp_and_protocol("},{"line_number":117,"context_line":"            idp_id, CONF.tokenless_auth.protocol)"}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_cd754364","line":114,"updated":"2015-07-15 19:57:47.000000000","message":"Don\u0027t use %!","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"8ada87ee5b062ac22c3cd494fd285e3982f06c4e","unresolved":false,"context_lines":[{"line_number":111,"context_line":"        \"\"\""},{"line_number":112,"context_line":"        idp_id \u003d self._build_idp_id(env)"},{"line_number":113,"context_line":"        LOG.debug(\u0027The IdP Id %s and protocol Id %s are used to look up \u0027"},{"line_number":114,"context_line":"                  \u0027the mapping.\u0027 % (idp_id, CONF.tokenless_auth.protocol))"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"        mapping \u003d self.federation_api.get_mapping_from_idp_and_protocol("},{"line_number":117,"context_line":"            idp_id, CONF.tokenless_auth.protocol)"}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_2ea7050c","line":114,"in_reply_to":"9a41bdd9_cd754364","updated":"2015-07-16 02:50:56.000000000","message":"done","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"a2cab849c5e8441c44c399393084b3484b548c58","unresolved":false,"context_lines":[{"line_number":158,"context_line":"            user_ref \u003d self.identity_api.get_user_by_name(user_name,"},{"line_number":159,"context_line":"                                                          user_domain_id)"},{"line_number":160,"context_line":"        else:"},{"line_number":161,"context_line":"            msg \u003d _LW(\u0027User auth cannot be built due to missing \u0027"},{"line_number":162,"context_line":"                      \u0027provided input: user Id is None or \u0027"},{"line_number":163,"context_line":"                      \u0027(user_name and domain_id) \u0027"},{"line_number":164,"context_line":"                      \u0027is None or (user_name and domain_name) is None\u0027)"}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_4dbdb3d6","line":161,"updated":"2015-07-15 19:57:47.000000000","message":"Why is this _LW? It should just be _","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9c52f7a8b1a41ed16a377d72b41a4b4e9b8e3e8a","unresolved":false,"context_lines":[{"line_number":157,"context_line":"            user_ref \u003d self.identity_api.get_user_by_name(user_name,"},{"line_number":158,"context_line":"                                                          user_domain_id)"},{"line_number":159,"context_line":"        else:"},{"line_number":160,"context_line":"            msg \u003d _LW(\u0027User auth cannot be built due to missing \u0027"},{"line_number":161,"context_line":"                      \u0027provided input: user Id is None or \u0027"},{"line_number":162,"context_line":"                      \u0027(user_name and domain_id) \u0027"},{"line_number":163,"context_line":"                      \u0027is None or (user_name and domain_name) is None\u0027)"}],"source_content_type":"text/x-python","patch_set":35,"id":"9a41bdd9_f20d72e8","line":160,"updated":"2015-07-16 04:55:44.000000000","message":"missed this one","commit_id":"0eb105e2f81d7e9a6a55e50d78d591c944b89b63"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"74ac95ebdfff974d0a5cc214d818b424765cf432","unresolved":false,"context_lines":[{"line_number":191,"context_line":"        try:"},{"line_number":192,"context_line":"            self.identity_api.assert_user_enabled("},{"line_number":193,"context_line":"                user_id\u003duser_ref[\u0027id\u0027],"},{"line_number":194,"context_line":"                user\u003duser_ref)"},{"line_number":195,"context_line":"        except AssertionError as e:"},{"line_number":196,"context_line":"            LOG.warning(_LW(\u0027User is disabled.\u0027))"},{"line_number":197,"context_line":"            six.reraise(exception.Unauthorized, exception.Unauthorized(e),"}],"source_content_type":"text/x-python","patch_set":36,"id":"9a41bdd9_2e6117d4","line":194,"updated":"2015-07-16 15:16:03.000000000","message":"this could also raise an Assertion error when the domain is disabled, so the warning msg \"\u0027User is disabled.\" is not accurate","commit_id":"78ee5cff332c817fa9bf3ac81ca49d0d476b40fe"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"36f9ae2f69d420a76d9eeb4488d8f3578508b7b1","unresolved":false,"context_lines":[{"line_number":191,"context_line":"        try:"},{"line_number":192,"context_line":"            self.identity_api.assert_user_enabled("},{"line_number":193,"context_line":"                user_id\u003duser_ref[\u0027id\u0027],"},{"line_number":194,"context_line":"                user\u003duser_ref)"},{"line_number":195,"context_line":"        except AssertionError as e:"},{"line_number":196,"context_line":"            LOG.warning(_LW(\u0027User is disabled.\u0027))"},{"line_number":197,"context_line":"            six.reraise(exception.Unauthorized, exception.Unauthorized(e),"}],"source_content_type":"text/x-python","patch_set":36,"id":"9a41bdd9_2d6274ae","line":194,"in_reply_to":"9a41bdd9_2e6117d4","updated":"2015-07-16 18:17:52.000000000","message":"well, user is effectively disabled so the error msg is sorta correct. :) I think the message is consistent with the rest.","commit_id":"78ee5cff332c817fa9bf3ac81ca49d0d476b40fe"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"61544dd1dcfe12d262b2ee2d717d58a2a4acbe5a","unresolved":false,"context_lines":[{"line_number":70,"context_line":"        else:"},{"line_number":71,"context_line":"            # must be a scoped token"},{"line_number":72,"context_line":"            raise exception.ValidationError("},{"line_number":73,"context_line":"                attribute\u003d\u0027project or domain\u0027,"},{"line_number":74,"context_line":"                target\u003d\u0027scope\u0027)"},{"line_number":75,"context_line":"        return scope"},{"line_number":76,"context_line":""}],"source_content_type":"text/x-python","patch_set":38,"id":"9a41bdd9_71761608","line":73,"updated":"2015-07-16 19:31:47.000000000","message":"Don\u0027t know if it should or shouldn\u0027t be internationalized, should it? Usually this is the attribute name which should not be translated. Here we are also using an English \u0027or\u0027.","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"bdcce290eed05722deaca8c9775b49517d0f8917","unresolved":false,"context_lines":[{"line_number":70,"context_line":"        else:"},{"line_number":71,"context_line":"            # must be a scoped token"},{"line_number":72,"context_line":"            raise exception.ValidationError("},{"line_number":73,"context_line":"                attribute\u003d\u0027project or domain\u0027,"},{"line_number":74,"context_line":"                target\u003d\u0027scope\u0027)"},{"line_number":75,"context_line":"        return scope"},{"line_number":76,"context_line":""}],"source_content_type":"text/x-python","patch_set":38,"id":"9a41bdd9_5a09a7dc","line":73,"in_reply_to":"9a41bdd9_71761608","updated":"2015-07-16 20:18:50.000000000","message":"Not sure. This models the existing pattern. But yeah, I think we need to reexamine it later.","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"61544dd1dcfe12d262b2ee2d717d58a2a4acbe5a","unresolved":false,"context_lines":[{"line_number":99,"context_line":"            SSL_CLIENT_S_DN_CN, SSL_CLIENT_S_DN_O"},{"line_number":100,"context_line":"        :param project_id:  Project scope of the mapped user."},{"line_number":101,"context_line":"        :param domain_id: Domain scope of the mapped user."},{"line_number":102,"context_line":"        :param ephemeral_user: If this option is ``true``, the user"},{"line_number":103,"context_line":"            referenced from the client certificate CN does not need to exist."},{"line_number":104,"context_line":"            A group needs to be defined in the corresponding mapping and"},{"line_number":105,"context_line":"            this ephemeral user will have the same roles as what are assigned"}],"source_content_type":"text/x-python","patch_set":38,"id":"9a41bdd9_115eaa76","line":102,"updated":"2015-07-16 19:31:47.000000000","message":"true or True?","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"bdcce290eed05722deaca8c9775b49517d0f8917","unresolved":false,"context_lines":[{"line_number":99,"context_line":"            SSL_CLIENT_S_DN_CN, SSL_CLIENT_S_DN_O"},{"line_number":100,"context_line":"        :param project_id:  Project scope of the mapped user."},{"line_number":101,"context_line":"        :param domain_id: Domain scope of the mapped user."},{"line_number":102,"context_line":"        :param ephemeral_user: If this option is ``true``, the user"},{"line_number":103,"context_line":"            referenced from the client certificate CN does not need to exist."},{"line_number":104,"context_line":"            A group needs to be defined in the corresponding mapping and"},{"line_number":105,"context_line":"            this ephemeral user will have the same roles as what are assigned"}],"source_content_type":"text/x-python","patch_set":38,"id":"9a41bdd9_9aff2faa","line":102,"in_reply_to":"9a41bdd9_115eaa76","updated":"2015-07-16 20:18:50.000000000","message":"done","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"61544dd1dcfe12d262b2ee2d717d58a2a4acbe5a","unresolved":false,"context_lines":[{"line_number":124,"context_line":"        user_domain_id \u003d user.get(\u0027domain_id\u0027)"},{"line_number":125,"context_line":"        user_domain_name \u003d user.get(\u0027domain_name\u0027)"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"        user_ref \u003d {}"},{"line_number":128,"context_line":"        if ephemeral_user:"},{"line_number":129,"context_line":"            group_ids \u003d mapped_properties[\u0027group_ids\u0027]"},{"line_number":130,"context_line":"            utils.validate_groups_in_backend(group_ids,"}],"source_content_type":"text/x-python","patch_set":38,"id":"9a41bdd9_f1422668","line":127,"updated":"2015-07-16 19:31:47.000000000","message":"Can this be moved into the \u0027if\u0027?","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"bdcce290eed05722deaca8c9775b49517d0f8917","unresolved":false,"context_lines":[{"line_number":124,"context_line":"        user_domain_id \u003d user.get(\u0027domain_id\u0027)"},{"line_number":125,"context_line":"        user_domain_name \u003d user.get(\u0027domain_name\u0027)"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"        user_ref \u003d {}"},{"line_number":128,"context_line":"        if ephemeral_user:"},{"line_number":129,"context_line":"            group_ids \u003d mapped_properties[\u0027group_ids\u0027]"},{"line_number":130,"context_line":"            utils.validate_groups_in_backend(group_ids,"}],"source_content_type":"text/x-python","patch_set":38,"id":"9a41bdd9_dae37704","line":127,"in_reply_to":"9a41bdd9_f1422668","updated":"2015-07-16 20:18:50.000000000","message":"done","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"61544dd1dcfe12d262b2ee2d717d58a2a4acbe5a","unresolved":false,"context_lines":[{"line_number":166,"context_line":"        return user_ref"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"    def _build_idp_id(self, env):"},{"line_number":169,"context_line":"        \"\"\"Build the IDP name from the given config option issuer_attribute."},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"        The default issuer attribute SSL_CLIENT_I_DN in the environment is"},{"line_number":172,"context_line":"        built with the following formula -"}],"source_content_type":"text/x-python","patch_set":38,"id":"9a41bdd9_f1e6a6af","line":169,"updated":"2015-07-16 19:31:47.000000000","message":"IdP?","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"bdcce290eed05722deaca8c9775b49517d0f8917","unresolved":false,"context_lines":[{"line_number":166,"context_line":"        return user_ref"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"    def _build_idp_id(self, env):"},{"line_number":169,"context_line":"        \"\"\"Build the IDP name from the given config option issuer_attribute."},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"        The default issuer attribute SSL_CLIENT_I_DN in the environment is"},{"line_number":172,"context_line":"        built with the following formula -"}],"source_content_type":"text/x-python","patch_set":38,"id":"9a41bdd9_daca976e","line":169,"in_reply_to":"9a41bdd9_f1e6a6af","updated":"2015-07-16 20:18:50.000000000","message":"done","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"61544dd1dcfe12d262b2ee2d717d58a2a4acbe5a","unresolved":false,"context_lines":[{"line_number":184,"context_line":"            raise exception.ConfigurationError(msg % {"},{"line_number":185,"context_line":"                \u0027issuer_attribute\u0027: CONF.tokenless_auth.issuer_attribute})"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"        hashed_idp \u003d hashlib.sha256(idp)"},{"line_number":188,"context_line":"        return base64.b64encode(hashed_idp.digest())"},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"    def _assert_user_is_enabled(self, user_ref):"}],"source_content_type":"text/x-python","patch_set":38,"id":"9a41bdd9_542f40f6","line":187,"updated":"2015-07-16 19:31:47.000000000","message":"This was to make the string URL safe, but I don\u0027t think that it does.... http://paste.openstack.org/show/381582/","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"bdcce290eed05722deaca8c9775b49517d0f8917","unresolved":false,"context_lines":[{"line_number":184,"context_line":"            raise exception.ConfigurationError(msg % {"},{"line_number":185,"context_line":"                \u0027issuer_attribute\u0027: CONF.tokenless_auth.issuer_attribute})"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"        hashed_idp \u003d hashlib.sha256(idp)"},{"line_number":188,"context_line":"        return base64.b64encode(hashed_idp.digest())"},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"    def _assert_user_is_enabled(self, user_ref):"}],"source_content_type":"text/x-python","patch_set":38,"id":"9a41bdd9_9a9baf72","line":187,"in_reply_to":"9a41bdd9_542f40f6","updated":"2015-07-16 20:18:50.000000000","message":"I agree. Will make the change.","commit_id":"ddc2c8a69507e8f2eecfa77c3d7101ccf676abd9"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"e64ac0161dad0f25fd7011c9e24a4fa1a3242680","unresolved":false,"context_lines":[{"line_number":137,"context_line":"                                                             project_id,"},{"line_number":138,"context_line":"                                                             domain_id)"},{"line_number":139,"context_line":"            role_names \u003d [role[\u0027name\u0027] for role in roles]"},{"line_number":140,"context_line":"            user_ref[\u0027group_ids\u0027] \u003d list(set(group_ids))"},{"line_number":141,"context_line":"            user_ref[federation.IDENTITY_PROVIDER] \u003d idp_id"},{"line_number":142,"context_line":"            user_ref[federation.PROTOCOL] \u003d CONF.tokenless_auth.protocol"},{"line_number":143,"context_line":"            if roles is not None:"}],"source_content_type":"text/x-python","patch_set":40,"id":"9a41bdd9_f96bc483","line":140,"updated":"2015-07-17 13:45:41.000000000","message":"(nit) I think that coercion to list is not necessary.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"2c33ae916ebbd68fd732974243450f94e2f78b05","unresolved":false,"context_lines":[{"line_number":137,"context_line":"                                                             project_id,"},{"line_number":138,"context_line":"                                                             domain_id)"},{"line_number":139,"context_line":"            role_names \u003d [role[\u0027name\u0027] for role in roles]"},{"line_number":140,"context_line":"            user_ref[\u0027group_ids\u0027] \u003d list(set(group_ids))"},{"line_number":141,"context_line":"            user_ref[federation.IDENTITY_PROVIDER] \u003d idp_id"},{"line_number":142,"context_line":"            user_ref[federation.PROTOCOL] \u003d CONF.tokenless_auth.protocol"},{"line_number":143,"context_line":"            if roles is not None:"}],"source_content_type":"text/x-python","patch_set":40,"id":"3a50d1a3_7dc4735e","line":140,"in_reply_to":"3a50d1a3_8c8281ff","updated":"2015-07-21 00:28:29.000000000","message":"using list(group_ids) is fine in this case.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"c96b984cb110bd0df4fb322c0657686604287e88","unresolved":false,"context_lines":[{"line_number":137,"context_line":"                                                             project_id,"},{"line_number":138,"context_line":"                                                             domain_id)"},{"line_number":139,"context_line":"            role_names \u003d [role[\u0027name\u0027] for role in roles]"},{"line_number":140,"context_line":"            user_ref[\u0027group_ids\u0027] \u003d list(set(group_ids))"},{"line_number":141,"context_line":"            user_ref[federation.IDENTITY_PROVIDER] \u003d idp_id"},{"line_number":142,"context_line":"            user_ref[federation.PROTOCOL] \u003d CONF.tokenless_auth.protocol"},{"line_number":143,"context_line":"            if roles is not None:"}],"source_content_type":"text/x-python","patch_set":40,"id":"3a50d1a3_8c8281ff","line":140,"in_reply_to":"9a41bdd9_f96bc483","updated":"2015-07-20 18:56:00.000000000","message":"good catch, but I will double check with test.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"e64ac0161dad0f25fd7011c9e24a4fa1a3242680","unresolved":false,"context_lines":[{"line_number":140,"context_line":"            user_ref[\u0027group_ids\u0027] \u003d list(set(group_ids))"},{"line_number":141,"context_line":"            user_ref[federation.IDENTITY_PROVIDER] \u003d idp_id"},{"line_number":142,"context_line":"            user_ref[federation.PROTOCOL] \u003d CONF.tokenless_auth.protocol"},{"line_number":143,"context_line":"            if roles is not None:"},{"line_number":144,"context_line":"                user_ref[\u0027roles\u0027] \u003d role_names"},{"line_number":145,"context_line":"            return user_ref"},{"line_number":146,"context_line":""}],"source_content_type":"text/x-python","patch_set":40,"id":"9a41bdd9_d91600a7","line":143,"updated":"2015-07-17 13:45:41.000000000","message":"If roles are None, line 139 will fail with \"TypeError: \u0027NoneType\u0027 object is not iterable\". Either this check needs to be reworked or line 139.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"c96b984cb110bd0df4fb322c0657686604287e88","unresolved":false,"context_lines":[{"line_number":140,"context_line":"            user_ref[\u0027group_ids\u0027] \u003d list(set(group_ids))"},{"line_number":141,"context_line":"            user_ref[federation.IDENTITY_PROVIDER] \u003d idp_id"},{"line_number":142,"context_line":"            user_ref[federation.PROTOCOL] \u003d CONF.tokenless_auth.protocol"},{"line_number":143,"context_line":"            if roles is not None:"},{"line_number":144,"context_line":"                user_ref[\u0027roles\u0027] \u003d role_names"},{"line_number":145,"context_line":"            return user_ref"},{"line_number":146,"context_line":""}],"source_content_type":"text/x-python","patch_set":40,"id":"3a50d1a3_2cf00d90","line":143,"in_reply_to":"9a41bdd9_d91600a7","updated":"2015-07-20 18:56:00.000000000","message":"good catch.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"e64ac0161dad0f25fd7011c9e24a4fa1a3242680","unresolved":false,"context_lines":[{"line_number":150,"context_line":"            if user_domain_name:"},{"line_number":151,"context_line":"                user_domain \u003d self.resource_api.get_domain_by_name("},{"line_number":152,"context_line":"                    user_domain_name)"},{"line_number":153,"context_line":"                self.resource_api.assert_domain_enabled(user_domain[\u0027id\u0027],"},{"line_number":154,"context_line":"                                                        user_domain)"},{"line_number":155,"context_line":"                user_domain_id \u003d user_domain[\u0027id\u0027]"},{"line_number":156,"context_line":"            user_ref \u003d self.identity_api.get_user_by_name(user_name,"}],"source_content_type":"text/x-python","patch_set":40,"id":"9a41bdd9_19e228a0","line":153,"updated":"2015-07-17 13:45:41.000000000","message":"this looks not tested. There is a test about user being disabled, but no test about domain being disabled.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"c96b984cb110bd0df4fb322c0657686604287e88","unresolved":false,"context_lines":[{"line_number":150,"context_line":"            if user_domain_name:"},{"line_number":151,"context_line":"                user_domain \u003d self.resource_api.get_domain_by_name("},{"line_number":152,"context_line":"                    user_domain_name)"},{"line_number":153,"context_line":"                self.resource_api.assert_domain_enabled(user_domain[\u0027id\u0027],"},{"line_number":154,"context_line":"                                                        user_domain)"},{"line_number":155,"context_line":"                user_domain_id \u003d user_domain[\u0027id\u0027]"},{"line_number":156,"context_line":"            user_ref \u003d self.identity_api.get_user_by_name(user_name,"}],"source_content_type":"text/x-python","patch_set":40,"id":"3a50d1a3_8c35a147","line":153,"in_reply_to":"9a41bdd9_19e228a0","updated":"2015-07-20 18:56:00.000000000","message":"will add the test","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"e64ac0161dad0f25fd7011c9e24a4fa1a3242680","unresolved":false,"context_lines":[{"line_number":157,"context_line":"                                                          user_domain_id)"},{"line_number":158,"context_line":"        else:"},{"line_number":159,"context_line":"            msg \u003d _(\u0027User auth cannot be built due to missing \u0027"},{"line_number":160,"context_line":"                    \u0027provided input: user Id is None or \u0027"},{"line_number":161,"context_line":"                    \u0027(user_name and domain_id) \u0027"},{"line_number":162,"context_line":"                    \u0027is None or (user_name and domain_name) is None\u0027)"},{"line_number":163,"context_line":"            raise exception.ValidationError(msg)"}],"source_content_type":"text/x-python","patch_set":40,"id":"9a41bdd9_99487889","line":160,"updated":"2015-07-17 13:45:41.000000000","message":"this \"user id is None or ...\" is not really human-readable. I suggest to tell something like \"due to not provided either user id, or user name with domain id, or user name with domain name\"","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"c96b984cb110bd0df4fb322c0657686604287e88","unresolved":false,"context_lines":[{"line_number":157,"context_line":"                                                          user_domain_id)"},{"line_number":158,"context_line":"        else:"},{"line_number":159,"context_line":"            msg \u003d _(\u0027User auth cannot be built due to missing \u0027"},{"line_number":160,"context_line":"                    \u0027provided input: user Id is None or \u0027"},{"line_number":161,"context_line":"                    \u0027(user_name and domain_id) \u0027"},{"line_number":162,"context_line":"                    \u0027is None or (user_name and domain_name) is None\u0027)"},{"line_number":163,"context_line":"            raise exception.ValidationError(msg)"}],"source_content_type":"text/x-python","patch_set":40,"id":"3a50d1a3_cc7969fe","line":160,"in_reply_to":"9a41bdd9_99487889","updated":"2015-07-20 18:56:00.000000000","message":"you got the point.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"e64ac0161dad0f25fd7011c9e24a4fa1a3242680","unresolved":false,"context_lines":[{"line_number":180,"context_line":"        if idp is None:"},{"line_number":181,"context_line":"            msg \u003d _(\u0027Could not determine Identity Provider Id based on \u0027"},{"line_number":182,"context_line":"                    \u0027env attribute %(issuer_attribute)s.\u0027)"},{"line_number":183,"context_line":"            raise exception.ConfigurationError(msg % {"},{"line_number":184,"context_line":"                \u0027issuer_attribute\u0027: CONF.tokenless_auth.issuer_attribute})"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"        hashed_idp \u003d hashlib.sha256(idp)"}],"source_content_type":"text/x-python","patch_set":40,"id":"9a41bdd9_ec4a2455","line":183,"updated":"2015-07-17 13:45:41.000000000","message":"why is this configuration error? I would not make a new exception for this kind of error. I suggest to take a look how it is being dealt with when a user provides non-existing attribute for, say, user_create.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"2c33ae916ebbd68fd732974243450f94e2f78b05","unresolved":false,"context_lines":[{"line_number":180,"context_line":"        if idp is None:"},{"line_number":181,"context_line":"            msg \u003d _(\u0027Could not determine Identity Provider Id based on \u0027"},{"line_number":182,"context_line":"                    \u0027env attribute %(issuer_attribute)s.\u0027)"},{"line_number":183,"context_line":"            raise exception.ConfigurationError(msg % {"},{"line_number":184,"context_line":"                \u0027issuer_attribute\u0027: CONF.tokenless_auth.issuer_attribute})"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"        hashed_idp \u003d hashlib.sha256(idp)"}],"source_content_type":"text/x-python","patch_set":40,"id":"3a50d1a3_bd78bb2c","line":183,"in_reply_to":"3a50d1a3_6cae1530","updated":"2015-07-21 00:28:29.000000000","message":"In face, it is actually a configuration error because the issuer is missing from the request environment. This attribute is required. If it is missing, most likely the configuration is wrong.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"c96b984cb110bd0df4fb322c0657686604287e88","unresolved":false,"context_lines":[{"line_number":180,"context_line":"        if idp is None:"},{"line_number":181,"context_line":"            msg \u003d _(\u0027Could not determine Identity Provider Id based on \u0027"},{"line_number":182,"context_line":"                    \u0027env attribute %(issuer_attribute)s.\u0027)"},{"line_number":183,"context_line":"            raise exception.ConfigurationError(msg % {"},{"line_number":184,"context_line":"                \u0027issuer_attribute\u0027: CONF.tokenless_auth.issuer_attribute})"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"        hashed_idp \u003d hashlib.sha256(idp)"}],"source_content_type":"text/x-python","patch_set":40,"id":"3a50d1a3_6cae1530","line":183,"in_reply_to":"9a41bdd9_ec4a2455","updated":"2015-07-20 18:56:00.000000000","message":"sure. will see how it\u0027s been done.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"e64ac0161dad0f25fd7011c9e24a4fa1a3242680","unresolved":false,"context_lines":[{"line_number":186,"context_line":"        hashed_idp \u003d hashlib.sha256(idp)"},{"line_number":187,"context_line":"        return hashed_idp.hexdigest()"},{"line_number":188,"context_line":""},{"line_number":189,"context_line":"    def _assert_user_is_enabled(self, user_ref):"},{"line_number":190,"context_line":"        try:"},{"line_number":191,"context_line":"            self.identity_api.assert_user_enabled("},{"line_number":192,"context_line":"                user_id\u003duser_ref[\u0027id\u0027],"}],"source_content_type":"text/x-python","patch_set":40,"id":"9a41bdd9_2c96cc94","line":189,"updated":"2015-07-17 13:45:41.000000000","message":"why is this function required? Why can\u0027t we use identity_api\u0027s assert_user_enabled directly?","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"c96b984cb110bd0df4fb322c0657686604287e88","unresolved":false,"context_lines":[{"line_number":186,"context_line":"        hashed_idp \u003d hashlib.sha256(idp)"},{"line_number":187,"context_line":"        return hashed_idp.hexdigest()"},{"line_number":188,"context_line":""},{"line_number":189,"context_line":"    def _assert_user_is_enabled(self, user_ref):"},{"line_number":190,"context_line":"        try:"},{"line_number":191,"context_line":"            self.identity_api.assert_user_enabled("},{"line_number":192,"context_line":"                user_id\u003duser_ref[\u0027id\u0027],"}],"source_content_type":"text/x-python","patch_set":40,"id":"3a50d1a3_8c3b61eb","line":189,"in_reply_to":"9a41bdd9_2c96cc94","updated":"2015-07-20 18:56:00.000000000","message":"true","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"e64ac0161dad0f25fd7011c9e24a4fa1a3242680","unresolved":false,"context_lines":[{"line_number":193,"context_line":"                user\u003duser_ref)"},{"line_number":194,"context_line":"        except AssertionError as e:"},{"line_number":195,"context_line":"            LOG.warning(_LW(\u0027User is disabled.\u0027))"},{"line_number":196,"context_line":"            six.reraise(exception.Unauthorized, exception.Unauthorized(e),"},{"line_number":197,"context_line":"                        sys.exc_info()[2])"}],"source_content_type":"text/x-python","patch_set":40,"id":"9a41bdd9_0cbbc80f","line":196,"updated":"2015-07-17 13:45:41.000000000","message":"I don\u0027t really like this craft of exceptions. What is it for?","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"99a8e51e8bba3291f7b20118fe500016df0ab8ac","unresolved":false,"context_lines":[{"line_number":177,"context_line":"        if idp is None:"},{"line_number":178,"context_line":"            msg \u003d _(\u0027Could not determine Identity Provider Id based on \u0027"},{"line_number":179,"context_line":"                    \u0027env attribute %(issuer_attribute)s.\u0027)"},{"line_number":180,"context_line":"            raise exception.ConfigurationError(msg % {"},{"line_number":181,"context_line":"                \u0027issuer_attribute\u0027: CONF.tokenless_auth.issuer_attribute})"},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"        hashed_idp \u003d hashlib.sha256(idp)"}],"source_content_type":"text/x-python","patch_set":47,"id":"3a50d1a3_ece54c0a","line":180,"updated":"2015-07-30 19:16:53.000000000","message":"Would it better to create a more specific type of Exception?\n\nsomething like TokenlessAuthConfigError?","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"288bb4dade83c0212c1f9f86638d0843b09cae40","unresolved":false,"context_lines":[{"line_number":177,"context_line":"        if idp is None:"},{"line_number":178,"context_line":"            msg \u003d _(\u0027Could not determine Identity Provider Id based on \u0027"},{"line_number":179,"context_line":"                    \u0027env attribute %(issuer_attribute)s.\u0027)"},{"line_number":180,"context_line":"            raise exception.ConfigurationError(msg % {"},{"line_number":181,"context_line":"                \u0027issuer_attribute\u0027: CONF.tokenless_auth.issuer_attribute})"},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"        hashed_idp \u003d hashlib.sha256(idp)"}],"source_content_type":"text/x-python","patch_set":47,"id":"3a50d1a3_d8a9ee25","line":180,"in_reply_to":"3a50d1a3_ece54c0a","updated":"2015-07-31 21:31:31.000000000","message":"I rather to keep it more generic here as the message can already identify the specific error. And the other implementation could also use the exception as well. \nUnless you or someone else strongly against this, or I just keep it as it is ;-)","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"afa73e0f8b7a198c1a22f345d5005af58bbf54c3","unresolved":false,"context_lines":[{"line_number":36,"context_line":"    def _build_scope_info(self, env):"},{"line_number":37,"context_line":"        \"\"\"Build the token request scope based on the headers."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"        :param env: request environment"},{"line_number":40,"context_line":"        :returns: scope data"},{"line_number":41,"context_line":"        :rtype: dict"},{"line_number":42,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":48,"id":"1a4dcd0f_b86949fa","line":39,"updated":"2015-08-12 04:26:21.000000000","message":"add:\n\n  :type env: dict","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"03e85143ccdc1c97ee94d14ac87aefcd7528ddf3","unresolved":false,"context_lines":[{"line_number":36,"context_line":"    def _build_scope_info(self, env):"},{"line_number":37,"context_line":"        \"\"\"Build the token request scope based on the headers."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"        :param env: request environment"},{"line_number":40,"context_line":"        :returns: scope data"},{"line_number":41,"context_line":"        :rtype: dict"},{"line_number":42,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":48,"id":"1a4dcd0f_e93ef7b6","line":39,"in_reply_to":"1a4dcd0f_b86949fa","updated":"2015-08-12 22:48:20.000000000","message":"done","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"0ae9d42b1085cba6a5225e8583fec5e3535a5535","unresolved":false,"context_lines":[{"line_number":65,"context_line":"        elif domain_name:"},{"line_number":66,"context_line":"            scope[\u0027domain\u0027] \u003d {\u0027name\u0027: domain_name}"},{"line_number":67,"context_line":"        else:"},{"line_number":68,"context_line":"            # must be a scoped token"},{"line_number":69,"context_line":"            raise exception.ValidationError("},{"line_number":70,"context_line":"                attribute\u003d\u0027project or domain\u0027,"},{"line_number":71,"context_line":"                target\u003d\u0027scope\u0027)"}],"source_content_type":"text/x-python","patch_set":48,"id":"1a4dcd0f_73995f78","line":68,"updated":"2015-08-07 10:49:23.000000000","message":"it\u0027s tokenless auth, there is no token","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"03e85143ccdc1c97ee94d14ac87aefcd7528ddf3","unresolved":false,"context_lines":[{"line_number":65,"context_line":"        elif domain_name:"},{"line_number":66,"context_line":"            scope[\u0027domain\u0027] \u003d {\u0027name\u0027: domain_name}"},{"line_number":67,"context_line":"        else:"},{"line_number":68,"context_line":"            # must be a scoped token"},{"line_number":69,"context_line":"            raise exception.ValidationError("},{"line_number":70,"context_line":"                attribute\u003d\u0027project or domain\u0027,"},{"line_number":71,"context_line":"                target\u003d\u0027scope\u0027)"}],"source_content_type":"text/x-python","patch_set":48,"id":"1a4dcd0f_29a61f0f","line":68,"in_reply_to":"1a4dcd0f_73995f78","updated":"2015-08-12 22:48:20.000000000","message":"incorrect comment, already removed and the exception already tells.","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"afa73e0f8b7a198c1a22f345d5005af58bbf54c3","unresolved":false,"context_lines":[{"line_number":175,"context_line":"        \"\"\""},{"line_number":176,"context_line":"        idp \u003d env.get(CONF.tokenless_auth.issuer_attribute)"},{"line_number":177,"context_line":"        if idp is None:"},{"line_number":178,"context_line":"            msg \u003d _(\u0027Could not determine Identity Provider Id based on \u0027"},{"line_number":179,"context_line":"                    \u0027env attribute %(issuer_attribute)s.\u0027)"},{"line_number":180,"context_line":"            raise exception.ConfigurationError(msg % {"},{"line_number":181,"context_line":"                \u0027issuer_attribute\u0027: CONF.tokenless_auth.issuer_attribute})"}],"source_content_type":"text/x-python","patch_set":48,"id":"1a4dcd0f_f8183186","line":178,"updated":"2015-08-12 04:26:21.000000000","message":"get rid of this message and just make the one in exceptions.py better","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"03e85143ccdc1c97ee94d14ac87aefcd7528ddf3","unresolved":false,"context_lines":[{"line_number":175,"context_line":"        \"\"\""},{"line_number":176,"context_line":"        idp \u003d env.get(CONF.tokenless_auth.issuer_attribute)"},{"line_number":177,"context_line":"        if idp is None:"},{"line_number":178,"context_line":"            msg \u003d _(\u0027Could not determine Identity Provider Id based on \u0027"},{"line_number":179,"context_line":"                    \u0027env attribute %(issuer_attribute)s.\u0027)"},{"line_number":180,"context_line":"            raise exception.ConfigurationError(msg % {"},{"line_number":181,"context_line":"                \u0027issuer_attribute\u0027: CONF.tokenless_auth.issuer_attribute})"}],"source_content_type":"text/x-python","patch_set":48,"id":"1a4dcd0f_89fad341","line":178,"in_reply_to":"1a4dcd0f_f8183186","updated":"2015-08-12 22:48:20.000000000","message":"done","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"960cb80720283eef0de77234e758267eb90a2d3d","unresolved":false,"context_lines":[{"line_number":152,"context_line":"            user_ref \u003d self.identity_api.get_user_by_name(user_name,"},{"line_number":153,"context_line":"                                                          user_domain_id)"},{"line_number":154,"context_line":"        else:"},{"line_number":155,"context_line":"            msg \u003d _(\u0027User auth cannot be built due to not provided either \u0027"},{"line_number":156,"context_line":"                    \u0027user id, or user name with domain id, or user name \u0027"},{"line_number":157,"context_line":"                    \u0027with domain name.\u0027)"},{"line_number":158,"context_line":"            raise exception.ValidationError(msg)"}],"source_content_type":"text/x-python","patch_set":50,"id":"fa1b9901_38b3109a","line":155,"updated":"2015-08-20 02:12:44.000000000","message":"\"due to not provided\" sounds a bit weird, maybe needs to be rephrased?","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5c35fe32e246aaf52a8f5de28d61a87faea3a722","unresolved":false,"context_lines":[{"line_number":152,"context_line":"            user_ref \u003d self.identity_api.get_user_by_name(user_name,"},{"line_number":153,"context_line":"                                                          user_domain_id)"},{"line_number":154,"context_line":"        else:"},{"line_number":155,"context_line":"            msg \u003d _(\u0027User auth cannot be built due to not provided either \u0027"},{"line_number":156,"context_line":"                    \u0027user id, or user name with domain id, or user name \u0027"},{"line_number":157,"context_line":"                    \u0027with domain name.\u0027)"},{"line_number":158,"context_line":"            raise exception.ValidationError(msg)"}],"source_content_type":"text/x-python","patch_set":50,"id":"fa1b9901_9ab8d72b","line":155,"in_reply_to":"fa1b9901_38b3109a","updated":"2015-08-21 01:19:55.000000000","message":"how\u0027s \"due to missing\"?","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"960cb80720283eef0de77234e758267eb90a2d3d","unresolved":false,"context_lines":[{"line_number":169,"context_line":""},{"line_number":170,"context_line":"        base64_idp \u003d sha1(env[\u0027SSL_CLIENT_I_DN\u0027])"},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"        :param env: HTTP request environment"},{"line_number":173,"context_line":"        :returns: base64_idp like the above example"},{"line_number":174,"context_line":"        :rtype: str"},{"line_number":175,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":50,"id":"fa1b9901_f87fd8a8","line":172,"updated":"2015-08-20 02:12:44.000000000","message":":type env: dict","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5c35fe32e246aaf52a8f5de28d61a87faea3a722","unresolved":false,"context_lines":[{"line_number":169,"context_line":""},{"line_number":170,"context_line":"        base64_idp \u003d sha1(env[\u0027SSL_CLIENT_I_DN\u0027])"},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"        :param env: HTTP request environment"},{"line_number":173,"context_line":"        :returns: base64_idp like the above example"},{"line_number":174,"context_line":"        :rtype: str"},{"line_number":175,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":50,"id":"fa1b9901_fa94738b","line":172,"in_reply_to":"fa1b9901_f87fd8a8","updated":"2015-08-21 01:19:55.000000000","message":"done.","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4c788126fa60aa52b961e499b650175ed9a26caf","unresolved":false,"context_lines":[{"line_number":176,"context_line":"        idp \u003d env.get(CONF.tokenless_auth.issuer_attribute)"},{"line_number":177,"context_line":"        if idp is None:"},{"line_number":178,"context_line":"            raise exception.TokenlessAuthConfigError("},{"line_number":179,"context_line":"                issuer_attribute\u003dCONF.tokenless_auth.issuer_attribute)"},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"        hashed_idp \u003d hashlib.sha256(idp)"},{"line_number":182,"context_line":"        return hashed_idp.hexdigest()"}],"source_content_type":"text/x-python","patch_set":50,"id":"1a4dcd0f_67518761","line":179,"updated":"2015-08-13 16:00:24.000000000","message":"this is written funny, i\u0027m gonna run it to double check it works, might want to add a test to check the content of the exception.","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"1c38f42539049bc777bcc2ecbe0fe3d831dad88a","unresolved":false,"context_lines":[{"line_number":176,"context_line":"        idp \u003d env.get(CONF.tokenless_auth.issuer_attribute)"},{"line_number":177,"context_line":"        if idp is None:"},{"line_number":178,"context_line":"            raise exception.TokenlessAuthConfigError("},{"line_number":179,"context_line":"                issuer_attribute\u003dCONF.tokenless_auth.issuer_attribute)"},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"        hashed_idp \u003d hashlib.sha256(idp)"},{"line_number":182,"context_line":"        return hashed_idp.hexdigest()"}],"source_content_type":"text/x-python","patch_set":50,"id":"1a4dcd0f_2404d816","line":179,"in_reply_to":"1a4dcd0f_67518761","updated":"2015-08-13 17:15:30.000000000","message":"yep, that works. I picked it up from other code.\nI will try to add a test if I will have to make another patch ;-)","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"b855d7436c76de567dae2d6451b38b78d528dffd","unresolved":false,"context_lines":[{"line_number":46,"context_line":"        project_domain_id \u003d env.get(\u0027HTTP_X_PROJECT_DOMAIN_ID\u0027)"},{"line_number":47,"context_line":"        project_domain_name \u003d env.get(\u0027HTTP_X_PROJECT_DOMAIN_NAME\u0027)"},{"line_number":48,"context_line":"        domain_id \u003d env.get(\u0027HTTP_X_DOMAIN_ID\u0027)"},{"line_number":49,"context_line":"        domain_name \u003d env.get(\u0027HTTP_X_DOMAIN_NAME\u0027)"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"        scope \u003d {}"},{"line_number":52,"context_line":"        if project_id:"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_177f62ab","line":49,"updated":"2015-08-27 12:57:53.000000000","message":"where do those values come from? who sets them?","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"d9e08f1ceb45ea04555b48d7b3fb86fd0991fe85","unresolved":false,"context_lines":[{"line_number":46,"context_line":"        project_domain_id \u003d env.get(\u0027HTTP_X_PROJECT_DOMAIN_ID\u0027)"},{"line_number":47,"context_line":"        project_domain_name \u003d env.get(\u0027HTTP_X_PROJECT_DOMAIN_NAME\u0027)"},{"line_number":48,"context_line":"        domain_id \u003d env.get(\u0027HTTP_X_DOMAIN_ID\u0027)"},{"line_number":49,"context_line":"        domain_name \u003d env.get(\u0027HTTP_X_DOMAIN_NAME\u0027)"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"        scope \u003d {}"},{"line_number":52,"context_line":"        if project_id:"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_cd3b84d0","line":49,"in_reply_to":"da20952f_177f62ab","updated":"2015-08-27 22:42:00.000000000","message":"the wsgi framework, it passes the http request headers attributes to env.\nplease have a look at the specs - http://specs.openstack.org/openstack/keystone-specs/specs/kilo/keystone-tokenless-authz-with-x509-ssl-client-cert.html","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"b855d7436c76de567dae2d6451b38b78d528dffd","unresolved":false,"context_lines":[{"line_number":58,"context_line":"            elif project_domain_name:"},{"line_number":59,"context_line":"                scope[\u0027project\u0027][\u0027domain\u0027] \u003d {\u0027name\u0027: project_domain_name}"},{"line_number":60,"context_line":"            else:"},{"line_number":61,"context_line":"                msg \u003d _(\u0027Project-domain Id or Project-domain name \u0027"},{"line_number":62,"context_line":"                        \u0027is not provided.\u0027)"},{"line_number":63,"context_line":"                raise exception.ValidationError(msg)"},{"line_number":64,"context_line":"        elif domain_id:"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_4c7d4d1b","line":61,"updated":"2015-08-27 12:57:53.000000000","message":"This would imply that both id and name must be always provided whereas the code seems to require just one of them.\n\n\"Neither Project Domain ID nor Project Domain Name was provided\" ?","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"d9e08f1ceb45ea04555b48d7b3fb86fd0991fe85","unresolved":false,"context_lines":[{"line_number":58,"context_line":"            elif project_domain_name:"},{"line_number":59,"context_line":"                scope[\u0027project\u0027][\u0027domain\u0027] \u003d {\u0027name\u0027: project_domain_name}"},{"line_number":60,"context_line":"            else:"},{"line_number":61,"context_line":"                msg \u003d _(\u0027Project-domain Id or Project-domain name \u0027"},{"line_number":62,"context_line":"                        \u0027is not provided.\u0027)"},{"line_number":63,"context_line":"                raise exception.ValidationError(msg)"},{"line_number":64,"context_line":"        elif domain_id:"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_4d753496","line":61,"in_reply_to":"da20952f_4c7d4d1b","updated":"2015-08-27 22:42:00.000000000","message":"done.","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18e1f6d929399c37afba2d62f138238541c71973","unresolved":false,"context_lines":[{"line_number":71,"context_line":"                target\u003d\u0027scope\u0027)"},{"line_number":72,"context_line":"        return scope"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    def get_scope(self, env):"},{"line_number":75,"context_line":"        auth \u003d {}"},{"line_number":76,"context_line":"        # NOTE(chioleong): auth methods here is insignificant because"},{"line_number":77,"context_line":"        # we only care about using auth.controllers.AuthInfo"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_e5b821e8","line":74,"updated":"2015-08-26 18:34:25.000000000","message":"it looks like all the methods in this class need env. would it be possible to make it a class variable?","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5a38c16026ca6a7252db7a0c48d38dd29ef7e852","unresolved":false,"context_lines":[{"line_number":71,"context_line":"                target\u003d\u0027scope\u0027)"},{"line_number":72,"context_line":"        return scope"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    def get_scope(self, env):"},{"line_number":75,"context_line":"        auth \u003d {}"},{"line_number":76,"context_line":"        # NOTE(chioleong): auth methods here is insignificant because"},{"line_number":77,"context_line":"        # we only care about using auth.controllers.AuthInfo"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_a4e2199e","line":74,"in_reply_to":"da20952f_e5b821e8","updated":"2015-08-27 03:51:32.000000000","message":"done","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"b855d7436c76de567dae2d6451b38b78d528dffd","unresolved":false,"context_lines":[{"line_number":119,"context_line":""},{"line_number":120,"context_line":"        # if user is ephemeral type, we don\u0027t care if the user exists"},{"line_number":121,"context_line":"        # or not, but just care if the mapped group(s) is valid."},{"line_number":122,"context_line":"        if user_type \u003d\u003d \u0027ephemeral\u0027:"},{"line_number":123,"context_line":"            user_ref \u003d {\u0027type\u0027: \u0027ephemeral\u0027}"},{"line_number":124,"context_line":"            group_ids \u003d mapped_properties[\u0027group_ids\u0027]"},{"line_number":125,"context_line":"            utils.validate_groups_in_backend(group_ids,"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_cc639d19","line":122,"updated":"2015-08-27 12:57:53.000000000","message":"You may want to use constant : federation.utils.UserType.EPHEMERAL","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"d9e08f1ceb45ea04555b48d7b3fb86fd0991fe85","unresolved":false,"context_lines":[{"line_number":119,"context_line":""},{"line_number":120,"context_line":"        # if user is ephemeral type, we don\u0027t care if the user exists"},{"line_number":121,"context_line":"        # or not, but just care if the mapped group(s) is valid."},{"line_number":122,"context_line":"        if user_type \u003d\u003d \u0027ephemeral\u0027:"},{"line_number":123,"context_line":"            user_ref \u003d {\u0027type\u0027: \u0027ephemeral\u0027}"},{"line_number":124,"context_line":"            group_ids \u003d mapped_properties[\u0027group_ids\u0027]"},{"line_number":125,"context_line":"            utils.validate_groups_in_backend(group_ids,"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_4d9c54c0","line":122,"in_reply_to":"da20952f_cc639d19","updated":"2015-08-27 22:42:00.000000000","message":"done","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"b855d7436c76de567dae2d6451b38b78d528dffd","unresolved":false,"context_lines":[{"line_number":163,"context_line":"        user_ref[\u0027type\u0027] \u003d \u0027local\u0027"},{"line_number":164,"context_line":"        return user_ref"},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"    def _build_idp_id(self, env):"},{"line_number":167,"context_line":"        \"\"\"Build the IdP name from the given config option issuer_attribute."},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"        The default issuer attribute SSL_CLIENT_I_DN in the environment is"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_4c5f8d41","line":166,"updated":"2015-08-27 12:57:53.000000000","message":"Idea for another patch: provide this as a option in keystone-manage.","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"d9e08f1ceb45ea04555b48d7b3fb86fd0991fe85","unresolved":false,"context_lines":[{"line_number":163,"context_line":"        user_ref[\u0027type\u0027] \u003d \u0027local\u0027"},{"line_number":164,"context_line":"        return user_ref"},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"    def _build_idp_id(self, env):"},{"line_number":167,"context_line":"        \"\"\"Build the IdP name from the given config option issuer_attribute."},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"        The default issuer attribute SSL_CLIENT_I_DN in the environment is"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_8faedc83","line":166,"in_reply_to":"da20952f_4c5f8d41","updated":"2015-08-27 22:42:00.000000000","message":"good question, there will be a follow-on patch to allow user to easily setup IdP from the given trusted ca certificate.","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d338bea3e6ae19a1c958d7d99347292a831b7bb3","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"    def get_scope(self):"},{"line_number":88,"context_line":"        auth \u003d {}"},{"line_number":89,"context_line":"        # NOTE(chioleong): auth methods here is insignificant because"},{"line_number":90,"context_line":"        # we only care about using auth.controllers.AuthInfo"},{"line_number":91,"context_line":"        # to validate the scope information. Therefore,"},{"line_number":92,"context_line":"        # we don\u0027t provide any identity here."}],"source_content_type":"text/x-python","patch_set":56,"id":"da20952f_fd764d3d","line":89,"updated":"2015-08-27 13:34:49.000000000","message":"s/is/are/","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"019cbb1766bd174d043356f6de9920ffb207767e","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"    def get_scope(self):"},{"line_number":88,"context_line":"        auth \u003d {}"},{"line_number":89,"context_line":"        # NOTE(chioleong): auth methods here is insignificant because"},{"line_number":90,"context_line":"        # we only care about using auth.controllers.AuthInfo"},{"line_number":91,"context_line":"        # to validate the scope information. Therefore,"},{"line_number":92,"context_line":"        # we don\u0027t provide any identity here."}],"source_content_type":"text/x-python","patch_set":56,"id":"da20952f_96e1229d","line":89,"in_reply_to":"da20952f_fd764d3d","updated":"2015-08-27 18:19:47.000000000","message":"done","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d338bea3e6ae19a1c958d7d99347292a831b7bb3","unresolved":false,"context_lines":[{"line_number":89,"context_line":"        # NOTE(chioleong): auth methods here is insignificant because"},{"line_number":90,"context_line":"        # we only care about using auth.controllers.AuthInfo"},{"line_number":91,"context_line":"        # to validate the scope information. Therefore,"},{"line_number":92,"context_line":"        # we don\u0027t provide any identity here."},{"line_number":93,"context_line":"        auth[\u0027scope\u0027] \u003d self._build_scope_info()"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"        # NOTE(chioleong): we\u0027ll let AuthInfo validate the scope for us"}],"source_content_type":"text/x-python","patch_set":56,"id":"da20952f_7d99dd6d","line":92,"updated":"2015-08-27 13:34:49.000000000","message":"s/here//","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"019cbb1766bd174d043356f6de9920ffb207767e","unresolved":false,"context_lines":[{"line_number":89,"context_line":"        # NOTE(chioleong): auth methods here is insignificant because"},{"line_number":90,"context_line":"        # we only care about using auth.controllers.AuthInfo"},{"line_number":91,"context_line":"        # to validate the scope information. Therefore,"},{"line_number":92,"context_line":"        # we don\u0027t provide any identity here."},{"line_number":93,"context_line":"        auth[\u0027scope\u0027] \u003d self._build_scope_info()"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"        # NOTE(chioleong): we\u0027ll let AuthInfo validate the scope for us"}],"source_content_type":"text/x-python","patch_set":56,"id":"da20952f_36bdb668","line":92,"in_reply_to":"da20952f_7d99dd6d","updated":"2015-08-27 18:19:47.000000000","message":"done","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d338bea3e6ae19a1c958d7d99347292a831b7bb3","unresolved":false,"context_lines":[{"line_number":182,"context_line":"        \"\"\""},{"line_number":183,"context_line":"        idp \u003d self.env.get(CONF.tokenless_auth.issuer_attribute)"},{"line_number":184,"context_line":"        if idp is None:"},{"line_number":185,"context_line":"            raise exception.TokenlessAuthConfigError("},{"line_number":186,"context_line":"                issuer_attribute\u003dCONF.tokenless_auth.issuer_attribute)"},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"        hashed_idp \u003d hashlib.sha256(idp)"}],"source_content_type":"text/x-python","patch_set":56,"id":"da20952f_92406058","line":185,"updated":"2015-08-27 13:34:49.000000000","message":"Is this a config error or a runtime error?","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"019cbb1766bd174d043356f6de9920ffb207767e","unresolved":false,"context_lines":[{"line_number":182,"context_line":"        \"\"\""},{"line_number":183,"context_line":"        idp \u003d self.env.get(CONF.tokenless_auth.issuer_attribute)"},{"line_number":184,"context_line":"        if idp is None:"},{"line_number":185,"context_line":"            raise exception.TokenlessAuthConfigError("},{"line_number":186,"context_line":"                issuer_attribute\u003dCONF.tokenless_auth.issuer_attribute)"},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"        hashed_idp \u003d hashlib.sha256(idp)"}],"source_content_type":"text/x-python","patch_set":56,"id":"da20952f_d6731ae6","line":185,"in_reply_to":"da20952f_92406058","updated":"2015-08-27 18:19:47.000000000","message":"I think it makes sense to raise a config error here.","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"d075a9f2d6a8687e4041eac4d67a79a8c35fc0e7","unresolved":false,"context_lines":[{"line_number":170,"context_line":"        self.identity_api.assert_user_enabled("},{"line_number":171,"context_line":"            user_id\u003duser_ref[\u0027id\u0027],"},{"line_number":172,"context_line":"            user\u003duser_ref)"},{"line_number":173,"context_line":"        user_ref[\u0027type\u0027] \u003d \u0027local\u0027"},{"line_number":174,"context_line":"        return user_ref"},{"line_number":175,"context_line":""},{"line_number":176,"context_line":"    def _build_idp_id(self):"}],"source_content_type":"text/x-python","patch_set":58,"id":"da20952f_9e0aef24","line":173,"updated":"2015-09-01 10:09:07.000000000","message":"nit, you can also user utils.UserType.LOCAL instead of literal","commit_id":"3c01f8762855e47f34823b76f5fd4a8780704718"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"b73ef343145505abddc850b642106be5b2b6b7cb","unresolved":false,"context_lines":[{"line_number":170,"context_line":"        self.identity_api.assert_user_enabled("},{"line_number":171,"context_line":"            user_id\u003duser_ref[\u0027id\u0027],"},{"line_number":172,"context_line":"            user\u003duser_ref)"},{"line_number":173,"context_line":"        user_ref[\u0027type\u0027] \u003d \u0027local\u0027"},{"line_number":174,"context_line":"        return user_ref"},{"line_number":175,"context_line":""},{"line_number":176,"context_line":"    def _build_idp_id(self):"}],"source_content_type":"text/x-python","patch_set":58,"id":"da20952f_f63e99d9","line":173,"in_reply_to":"da20952f_9e0aef24","updated":"2015-09-02 00:09:20.000000000","message":"done","commit_id":"3c01f8762855e47f34823b76f5fd4a8780704718"}],"keystone/contrib/federation/utils.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":384,"context_line":"                for local in rule[\u0027local\u0027]:"},{"line_number":385,"context_line":"                    new_local \u003d self._update_local_mapping(local, direct_maps)"},{"line_number":386,"context_line":"                    identity_values.append(new_local)"},{"line_number":387,"context_line":"                    "},{"line_number":388,"context_line":"        LOG.debug(\u0027identity_values: %s\u0027, identity_values)"},{"line_number":389,"context_line":"        mapped_properties \u003d self._transform(identity_values)"},{"line_number":390,"context_line":"        LOG.debug(\u0027mapped_properties: %s\u0027, mapped_properties)"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_ad4557b5","line":387,"updated":"2015-02-18 04:09:12.000000000","message":"undo this change","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2980c8fc4ec04546375fa362d53b2d238a90cebf","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"ba7be1f8_d0eefeeb","updated":"2015-02-21 05:04:37.000000000","message":"general FYI here, might want to review marek\u0027s patch here: https://review.openstack.org/#/c/154934/13/keystone/contrib/federation/utils.py as it\u0027s close to merging and will affect this function.\n\ni think it might easier since it\u0027ll just grab the entire \u0027user\u0027 value","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"7e05c24fcc95f788a0847b6fe749a2904559f419","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"ba7be1f8_d2bcaabd","in_reply_to":"ba7be1f8_ae0ca643","updated":"2015-02-25 21:18:26.000000000","message":"We can consolidate the two later. This patch is explicitly checking for either user_id or username \u0026 domain.","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"fc1c53e4db3bc7ffae4618bc40ffaa0b1fb2621c","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"ba7be1f8_ae0ca643","in_reply_to":"ba7be1f8_d0eefeeb","updated":"2015-02-23 19:11:13.000000000","message":"thx, will look at that.","commit_id":"2222135f557959268e797596cf44a1baa8963787"}],"keystone/exception.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"afa73e0f8b7a198c1a22f345d5005af58bbf54c3","unresolved":false,"context_lines":[{"line_number":478,"context_line":"    title \u003d \u0027Error retrieving OAuth headers\u0027"},{"line_number":479,"context_line":""},{"line_number":480,"context_line":""},{"line_number":481,"context_line":"class ConfigurationError(Error):"},{"line_number":482,"context_line":"    message_format \u003d _(\u0027The configuration option %(attribute)s provided does \u0027"},{"line_number":483,"context_line":"                       \u0027not seem to be the expected one.\u0027)"}],"source_content_type":"text/x-python","patch_set":48,"id":"1a4dcd0f_2388ae70","line":481,"updated":"2015-08-12 04:26:21.000000000","message":"inheriting from Error doesn\u0027t given you an HTTP code, inherit from ValidationError or something...  expected to find issuer_attribute in request environment seems to make sense to me.\n\nAlso rename this to something TokenlessAuth specific, TokenlessAuthConfigError?","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"03e85143ccdc1c97ee94d14ac87aefcd7528ddf3","unresolved":false,"context_lines":[{"line_number":478,"context_line":"    title \u003d \u0027Error retrieving OAuth headers\u0027"},{"line_number":479,"context_line":""},{"line_number":480,"context_line":""},{"line_number":481,"context_line":"class ConfigurationError(Error):"},{"line_number":482,"context_line":"    message_format \u003d _(\u0027The configuration option %(attribute)s provided does \u0027"},{"line_number":483,"context_line":"                       \u0027not seem to be the expected one.\u0027)"}],"source_content_type":"text/x-python","patch_set":48,"id":"1a4dcd0f_69f3c773","line":481,"in_reply_to":"1a4dcd0f_2388ae70","updated":"2015-08-12 22:48:20.000000000","message":"done","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"afa73e0f8b7a198c1a22f345d5005af58bbf54c3","unresolved":false,"context_lines":[{"line_number":479,"context_line":""},{"line_number":480,"context_line":""},{"line_number":481,"context_line":"class ConfigurationError(Error):"},{"line_number":482,"context_line":"    message_format \u003d _(\u0027The configuration option %(attribute)s provided does \u0027"},{"line_number":483,"context_line":"                       \u0027not seem to be the expected one.\u0027)"}],"source_content_type":"text/x-python","patch_set":48,"id":"1a4dcd0f_e3588633","line":482,"updated":"2015-08-12 04:26:21.000000000","message":"use more strict language:\n\n  Could not determine Identity Provider ID. The configuration option %(issuer_attribute)s provided was not found in the request environment,","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"03e85143ccdc1c97ee94d14ac87aefcd7528ddf3","unresolved":false,"context_lines":[{"line_number":479,"context_line":""},{"line_number":480,"context_line":""},{"line_number":481,"context_line":"class ConfigurationError(Error):"},{"line_number":482,"context_line":"    message_format \u003d _(\u0027The configuration option %(attribute)s provided does \u0027"},{"line_number":483,"context_line":"                       \u0027not seem to be the expected one.\u0027)"}],"source_content_type":"text/x-python","patch_set":48,"id":"1a4dcd0f_09e6c3af","line":482,"in_reply_to":"1a4dcd0f_e3588633","updated":"2015-08-12 22:48:20.000000000","message":"done","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18e1f6d929399c37afba2d62f138238541c71973","unresolved":false,"context_lines":[{"line_number":480,"context_line":""},{"line_number":481,"context_line":"class TokenlessAuthConfigError(ValidationError):"},{"line_number":482,"context_line":"    message_format \u003d _(\u0027Could not determine Identity Provider ID. The \u0027"},{"line_number":483,"context_line":"                       \u0027configuration option %(issuer_attribute)s provided \u0027"},{"line_number":484,"context_line":"                       \u0027was not found in the request environment.\u0027)"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_c5aabd85","line":483,"updated":"2015-08-26 18:34:25.000000000","message":"nit: s/provided//","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5a38c16026ca6a7252db7a0c48d38dd29ef7e852","unresolved":false,"context_lines":[{"line_number":480,"context_line":""},{"line_number":481,"context_line":"class TokenlessAuthConfigError(ValidationError):"},{"line_number":482,"context_line":"    message_format \u003d _(\u0027Could not determine Identity Provider ID. The \u0027"},{"line_number":483,"context_line":"                       \u0027configuration option %(issuer_attribute)s provided \u0027"},{"line_number":484,"context_line":"                       \u0027was not found in the request environment.\u0027)"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_e4ffb132","line":483,"in_reply_to":"da20952f_c5aabd85","updated":"2015-08-27 03:51:32.000000000","message":"done","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"}],"keystone/middleware/core.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":119,"context_line":"            e \u003d exception.ValidationError(attribute\u003d\u0027application/json\u0027,"},{"line_number":120,"context_line":"                                          target\u003d\u0027Content-Type header\u0027)"},{"line_number":121,"context_line":"            return wsgi.render_exception(e, request\u003drequest)"},{"line_number":122,"context_line":"        "},{"line_number":123,"context_line":"        params_parsed \u003d {}"},{"line_number":124,"context_line":"        try:"},{"line_number":125,"context_line":"            params_parsed \u003d jsonutils.loads(params_json)"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_2d096784","line":122,"updated":"2015-02-18 04:09:12.000000000","message":"undo this change","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":241,"context_line":"        token_helper \u003d common.V3TokenDataHelper()"},{"line_number":242,"context_line":"        token_data \u003d token_helper.get_token_data("},{"line_number":243,"context_line":"                        user_id\u003duser_ref[\u0027id\u0027], "},{"line_number":244,"context_line":"                        method_names\u003d[\u0027x509\u0027],"},{"line_number":245,"context_line":"                        extras\u003d{},"},{"line_number":246,"context_line":"                        domain_id\u003ddomain_id,"},{"line_number":247,"context_line":"                        project_id\u003dproject_id"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_cd19abd2","line":244,"updated":"2015-02-18 04:09:12.000000000","message":"this is once again making me uncomfortable, we should have the protocol name as a config option, just for the tokenless auth case","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":256,"context_line":"        auth_context[\u0027roles\u0027] \u003d [role[\u0027name\u0027] for role in token_data[\u0027token\u0027][\u0027roles\u0027]]"},{"line_number":257,"context_line":"        return auth_context"},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"    def _validate_truested_issuer(self, client_issuer):"},{"line_number":260,"context_line":"        \"\"\"To further filter the certificates that are allowed to participate "},{"line_number":261,"context_line":"        in tokenless authorization. If the config option \u0027trusted_issuers\u0027"},{"line_number":262,"context_line":"        is absent or not containing any trusted issuer DNs, no certificates"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_edc74f10","line":259,"updated":"2015-02-18 04:09:12.000000000","message":"s/truested/trusted","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":265,"context_line":"        :param client_issuer: The client issuer to be trusted"},{"line_number":266,"context_line":"        :returns: True is client_issuer is trusted; otherwise False"},{"line_number":267,"context_line":"        \"\"\""},{"line_number":268,"context_line":"        trusted \u003d False"},{"line_number":269,"context_line":"        "},{"line_number":270,"context_line":"        # NOTE(chioleong): The trusted issuers replace the special "},{"line_number":271,"context_line":"        # character commas in the string using the url %2C escape quoted"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_cda36b41","line":268,"updated":"2015-02-18 04:09:12.000000000","message":"no need for this variable","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":272,"context_line":"        for dn in CONF.auth.trusted_issuers:"},{"line_number":273,"context_line":"            # dn is url quoted and client_issuer is not."},{"line_number":274,"context_line":"            if ldap_core.is_dn_equal(urllib.unquote(dn), client_issuer):"},{"line_number":275,"context_line":"                trusted \u003d True"},{"line_number":276,"context_line":"                break"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"        return trusted"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_4db85b75","line":275,"updated":"2015-02-18 04:09:12.000000000","message":"return True here","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":275,"context_line":"                trusted \u003d True"},{"line_number":276,"context_line":"                break"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"        return trusted"},{"line_number":279,"context_line":"            "},{"line_number":280,"context_line":"    def _is_ssl_authz_applicable(self, env):"},{"line_number":281,"context_line":"        issuer_attr_present \u003d \u0027SSL_CLIENT_I_DN\u0027 in env"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_8dadf333","line":278,"updated":"2015-02-18 04:09:12.000000000","message":"return False here","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":300,"context_line":"        auth_context \u003d None"},{"line_number":301,"context_line":"        if AUTH_TOKEN_HEADER in request.headers:"},{"line_number":302,"context_line":"            auth_context \u003d self._build_auth_context(request)"},{"line_number":303,"context_line":"        elif (self._is_ssl_authz_applicable(request.environ) and"},{"line_number":304,"context_line":"            self._validate_truested_issuer(request.environ[\u0027SSL_CLIENT_I_DN\u0027])):"},{"line_number":305,"context_line":"            auth_context \u003d self._build_auth_context_from_ssl_request("},{"line_number":306,"context_line":"                request.environ)"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_0d9bc318","line":303,"updated":"2015-02-18 04:09:12.000000000","message":"brackets are unnecessary here","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":301,"context_line":"        if AUTH_TOKEN_HEADER in request.headers:"},{"line_number":302,"context_line":"            auth_context \u003d self._build_auth_context(request)"},{"line_number":303,"context_line":"        elif (self._is_ssl_authz_applicable(request.environ) and"},{"line_number":304,"context_line":"            self._validate_truested_issuer(request.environ[\u0027SSL_CLIENT_I_DN\u0027])):"},{"line_number":305,"context_line":"            auth_context \u003d self._build_auth_context_from_ssl_request("},{"line_number":306,"context_line":"                request.environ)"},{"line_number":307,"context_line":"        LOG.debug(\u0027RBAC: auth_context: %s\u0027, auth_context)"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_8d86d3b7","line":304,"updated":"2015-02-18 04:09:12.000000000","message":"we should either document that SSL_CLIENT_I_DN is always needed or make it a config option","commit_id":"6d7830537383921a50603adc6197712e54b1fd29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2980c8fc4ec04546375fa362d53b2d238a90cebf","unresolved":false,"context_lines":[{"line_number":228,"context_line":"            LOG.warning(_LW(\u0027RBAC: Invalid token\u0027))"},{"line_number":229,"context_line":"            raise exception.Unauthorized()"},{"line_number":230,"context_line":""},{"line_number":231,"context_line":"    def _build_auth_context_from_ssl_request(self, env):"},{"line_number":232,"context_line":"        tokenless_helper \u003d tokenless_auth.TokenlessAuthHelper()"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"        (domain_id, project_id, trust_ref, unscoped) \u003d ("}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_30de7a40","line":231,"updated":"2015-02-21 05:04:37.000000000","message":"add a docstring","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2980c8fc4ec04546375fa362d53b2d238a90cebf","unresolved":false,"context_lines":[{"line_number":269,"context_line":"            # dn is url quoted and client_issuer is not."},{"line_number":270,"context_line":"            if ldap_core.is_dn_equal(urllib.unquote(dn), client_issuer):"},{"line_number":271,"context_line":"                return True"},{"line_number":272,"context_line":""},{"line_number":273,"context_line":"        return False"},{"line_number":274,"context_line":""},{"line_number":275,"context_line":"    def _is_ssl_authz_applicable(self, env):"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_10d97657","line":272,"updated":"2015-02-21 05:04:37.000000000","message":"add some logging here, debugging ldap values can be incredibly frustrating","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"fc1c53e4db3bc7ffae4618bc40ffaa0b1fb2621c","unresolved":false,"context_lines":[{"line_number":269,"context_line":"            # dn is url quoted and client_issuer is not."},{"line_number":270,"context_line":"            if ldap_core.is_dn_equal(urllib.unquote(dn), client_issuer):"},{"line_number":271,"context_line":"                return True"},{"line_number":272,"context_line":""},{"line_number":273,"context_line":"        return False"},{"line_number":274,"context_line":""},{"line_number":275,"context_line":"    def _is_ssl_authz_applicable(self, env):"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_8c0feb2d","line":272,"in_reply_to":"ba7be1f8_10d97657","updated":"2015-02-23 19:11:13.000000000","message":"agree.","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2980c8fc4ec04546375fa362d53b2d238a90cebf","unresolved":false,"context_lines":[{"line_number":275,"context_line":"    def _is_ssl_authz_applicable(self, env):"},{"line_number":276,"context_line":"        issuer_attr_present \u003d CONF.auth.issuer_attri in env"},{"line_number":277,"context_line":"        scope_present \u003d (\u0027HTTP_X_PROJECT_ID\u0027 in env or"},{"line_number":278,"context_line":"                         (\u0027HTTP_X_PROJECT_NAME\u0027 in env and"},{"line_number":279,"context_line":"                          (\u0027HTTP_X_PROJECT_DOMAIN_ID\u0027 in env or"},{"line_number":280,"context_line":"                           \u0027HTTP_X_PROJECT_DOMAIN_NAME\u0027 in env)))"},{"line_number":281,"context_line":"        return issuer_attr_present and scope_present"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_b06c2a9e","line":278,"updated":"2015-02-21 05:04:37.000000000","message":"this logic won\u0027t work, in the case of just project_domain_name being available it\u0027ll be evaluated as True, when it shouldn\u0027t be\n\n  \u003e\u003e\u003e proj_id \u003d False\n  \u003e\u003e\u003e proj_name \u003d False\n  \u003e\u003e\u003e proj_dom_id \u003d False\n  \u003e\u003e\u003e proj_dom_name \u003d True \n  \u003e\u003e\u003e print (proj_id or proj_name and proj_dom_id or proj_dom_name)\n  True\n\nthe parentheses are missing, and everything is being evaluated as a whole, a clear distinction between the scopes is required.\n\n  \u003e\u003e\u003e print (proj_id or (proj_name and (proj_dom_id or proj_dom_name)))\n  False\n\nit might be easier to break things down a bit","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"7e05c24fcc95f788a0847b6fe749a2904559f419","unresolved":false,"context_lines":[{"line_number":275,"context_line":"    def _is_ssl_authz_applicable(self, env):"},{"line_number":276,"context_line":"        issuer_attr_present \u003d CONF.auth.issuer_attri in env"},{"line_number":277,"context_line":"        scope_present \u003d (\u0027HTTP_X_PROJECT_ID\u0027 in env or"},{"line_number":278,"context_line":"                         (\u0027HTTP_X_PROJECT_NAME\u0027 in env and"},{"line_number":279,"context_line":"                          (\u0027HTTP_X_PROJECT_DOMAIN_ID\u0027 in env or"},{"line_number":280,"context_line":"                           \u0027HTTP_X_PROJECT_DOMAIN_NAME\u0027 in env)))"},{"line_number":281,"context_line":"        return issuer_attr_present and scope_present"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_d2182ad5","line":278,"in_reply_to":"ba7be1f8_2c143f4d","updated":"2015-02-25 21:18:26.000000000","message":"the parentheses look correct to me","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"fc1c53e4db3bc7ffae4618bc40ffaa0b1fb2621c","unresolved":false,"context_lines":[{"line_number":275,"context_line":"    def _is_ssl_authz_applicable(self, env):"},{"line_number":276,"context_line":"        issuer_attr_present \u003d CONF.auth.issuer_attri in env"},{"line_number":277,"context_line":"        scope_present \u003d (\u0027HTTP_X_PROJECT_ID\u0027 in env or"},{"line_number":278,"context_line":"                         (\u0027HTTP_X_PROJECT_NAME\u0027 in env and"},{"line_number":279,"context_line":"                          (\u0027HTTP_X_PROJECT_DOMAIN_ID\u0027 in env or"},{"line_number":280,"context_line":"                           \u0027HTTP_X_PROJECT_DOMAIN_NAME\u0027 in env)))"},{"line_number":281,"context_line":"        return issuer_attr_present and scope_present"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_2c143f4d","line":278,"in_reply_to":"ba7be1f8_b06c2a9e","updated":"2015-02-23 19:11:13.000000000","message":"the parentheses are actually there and it will return False in this case, but it may be a good idea to break it down a bit.","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2980c8fc4ec04546375fa362d53b2d238a90cebf","unresolved":false,"context_lines":[{"line_number":278,"context_line":"                         (\u0027HTTP_X_PROJECT_NAME\u0027 in env and"},{"line_number":279,"context_line":"                          (\u0027HTTP_X_PROJECT_DOMAIN_ID\u0027 in env or"},{"line_number":280,"context_line":"                           \u0027HTTP_X_PROJECT_DOMAIN_NAME\u0027 in env)))"},{"line_number":281,"context_line":"        return issuer_attr_present and scope_present"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":"    def process_request(self, request):"},{"line_number":284,"context_line":"        if authorization.AUTH_CONTEXT_ENV in request.environ:"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_100b36d7","line":281,"updated":"2015-02-21 05:04:37.000000000","message":"you should probably log something here\n\nLike when the issuer is missing. or if scope is False.\n\n\"hey the issuer is missing, check CONF.blah\" \n\nor \"hey we couldn\u0027t find a scope, but here\u0027s what we saw\" -\n\nI say this because presently if any of these fail the user will only know when the auth context is returned.","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"fc1c53e4db3bc7ffae4618bc40ffaa0b1fb2621c","unresolved":false,"context_lines":[{"line_number":278,"context_line":"                         (\u0027HTTP_X_PROJECT_NAME\u0027 in env and"},{"line_number":279,"context_line":"                          (\u0027HTTP_X_PROJECT_DOMAIN_ID\u0027 in env or"},{"line_number":280,"context_line":"                           \u0027HTTP_X_PROJECT_DOMAIN_NAME\u0027 in env)))"},{"line_number":281,"context_line":"        return issuer_attr_present and scope_present"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":"    def process_request(self, request):"},{"line_number":284,"context_line":"        if authorization.AUTH_CONTEXT_ENV in request.environ:"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba7be1f8_4c17b351","line":281,"in_reply_to":"ba7be1f8_100b36d7","updated":"2015-02-23 19:11:13.000000000","message":"yeah, agree on that.","commit_id":"2222135f557959268e797596cf44a1baa8963787"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"7875b6a633f827cdbb3352606adfe0c15790b641","unresolved":false,"context_lines":[{"line_number":264,"context_line":"        :returns: True is client_issuer is trusted; otherwise False"},{"line_number":265,"context_line":"        \"\"\""},{"line_number":266,"context_line":""},{"line_number":267,"context_line":"        if client_issuer \u003d\u003d CONF.tokenless_auth.trusted_issuer:"},{"line_number":268,"context_line":"            return True"},{"line_number":269,"context_line":""},{"line_number":270,"context_line":"        LOG.debug(\u0027The client issuer %s does not match with the trusted \u0027"}],"source_content_type":"text/x-python","patch_set":12,"id":"9a80dd14_90d03af9","line":267,"updated":"2015-03-04 07:24:12.000000000","message":"Trusteed issuer should be list and this comparison needs to be revisited","commit_id":"550e15b5c613189d1eae6340f2d69dc5536dba64"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"fee15e222162e16b251688101c40468fa1d308b0","unresolved":false,"context_lines":[{"line_number":264,"context_line":"        :returns: True is client_issuer is trusted; otherwise False"},{"line_number":265,"context_line":"        \"\"\""},{"line_number":266,"context_line":""},{"line_number":267,"context_line":"        if client_issuer \u003d\u003d CONF.tokenless_auth.trusted_issuer:"},{"line_number":268,"context_line":"            return True"},{"line_number":269,"context_line":""},{"line_number":270,"context_line":"        LOG.debug(\u0027The client issuer %s does not match with the trusted \u0027"}],"source_content_type":"text/x-python","patch_set":12,"id":"9a80dd14_7b5c8726","line":267,"in_reply_to":"9a80dd14_90d03af9","updated":"2015-03-04 07:42:28.000000000","message":"See my comment in config.py","commit_id":"550e15b5c613189d1eae6340f2d69dc5536dba64"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8609e4e084b46909ce679e369816740b431ee371","unresolved":false,"context_lines":[{"line_number":273,"context_line":"        return False"},{"line_number":274,"context_line":""},{"line_number":275,"context_line":"    def _is_ssl_authz_applicable(self, env):"},{"line_number":276,"context_line":"        issuer_attr_present \u003d CONF.tokenless_auth.issuer_attribute in env"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"        project_scope_present \u003d False"},{"line_number":279,"context_line":"        if \u0027HTTP_X_PROJECT_ID\u0027 in env:"}],"source_content_type":"text/x-python","patch_set":12,"id":"9a80dd14_8d71057a","line":276,"updated":"2015-03-04 06:38:22.000000000","message":"this line feels more like validating the trusted issuer, and the rest of this feels like verifying the scope","commit_id":"550e15b5c613189d1eae6340f2d69dc5536dba64"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"c25c1222b90b277ffd47a0f39942b0c77ff0f46c","unresolved":false,"context_lines":[{"line_number":273,"context_line":"        return False"},{"line_number":274,"context_line":""},{"line_number":275,"context_line":"    def _is_ssl_authz_applicable(self, env):"},{"line_number":276,"context_line":"        issuer_attr_present \u003d CONF.tokenless_auth.issuer_attribute in env"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"        project_scope_present \u003d False"},{"line_number":279,"context_line":"        if \u0027HTTP_X_PROJECT_ID\u0027 in env:"}],"source_content_type":"text/x-python","patch_set":12,"id":"9a80dd14_cf7cac75","line":276,"in_reply_to":"9a80dd14_8d71057a","updated":"2015-03-04 22:53:41.000000000","message":"yeah, agree. Thanks for the suggestions and they are definitely more readable.","commit_id":"550e15b5c613189d1eae6340f2d69dc5536dba64"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"7875b6a633f827cdbb3352606adfe0c15790b641","unresolved":false,"context_lines":[{"line_number":275,"context_line":"    def _is_ssl_authz_applicable(self, env):"},{"line_number":276,"context_line":"        issuer_attr_present \u003d CONF.tokenless_auth.issuer_attribute in env"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"        project_scope_present \u003d False"},{"line_number":279,"context_line":"        if \u0027HTTP_X_PROJECT_ID\u0027 in env:"},{"line_number":280,"context_line":"            project_scope_present \u003d True"},{"line_number":281,"context_line":"        elif \u0027HTTP_X_PROJECT_NAME\u0027 in env:"}],"source_content_type":"text/x-python","patch_set":12,"id":"9a80dd14_b069be27","line":278,"updated":"2015-03-04 07:24:12.000000000","message":"Can\u0027t we deduce the scope from    tokenless_helper.get_scope(), why do we need to repeat this once again?","commit_id":"550e15b5c613189d1eae6340f2d69dc5536dba64"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"c25c1222b90b277ffd47a0f39942b0c77ff0f46c","unresolved":false,"context_lines":[{"line_number":275,"context_line":"    def _is_ssl_authz_applicable(self, env):"},{"line_number":276,"context_line":"        issuer_attr_present \u003d CONF.tokenless_auth.issuer_attribute in env"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"        project_scope_present \u003d False"},{"line_number":279,"context_line":"        if \u0027HTTP_X_PROJECT_ID\u0027 in env:"},{"line_number":280,"context_line":"            project_scope_present \u003d True"},{"line_number":281,"context_line":"        elif \u0027HTTP_X_PROJECT_NAME\u0027 in env:"}],"source_content_type":"text/x-python","patch_set":12,"id":"9a80dd14_ef87b00d","line":278,"in_reply_to":"9a80dd14_b069be27","updated":"2015-03-04 22:53:41.000000000","message":"I rather to return out earlier if there is any validation failures, instead of making calls to underneath APIs and return error later.","commit_id":"550e15b5c613189d1eae6340f2d69dc5536dba64"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"b5e1abb181363a4ae665762902c5f5f6601e2e2e","unresolved":false,"context_lines":[{"line_number":227,"context_line":"            raise exception.Unauthorized()"},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"    def _build_tokenless_auth_context(self, env):"},{"line_number":230,"context_line":"        \"\"\"Build the authentication context based on the attributes"},{"line_number":231,"context_line":"        provided in the env."},{"line_number":232,"context_line":"        \"\"\""},{"line_number":233,"context_line":"        tokenless_helper \u003d tokenless_auth.TokenlessAuthHelper()"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a80dd14_d75ef1e8","line":230,"updated":"2015-03-05 07:56:34.000000000","message":"fix up the doc string formatting here,\n\n  \"\"\"one liner summary.\n\n  multi-line comments\n  go here\n  \"\"\"","commit_id":"7ac24a995cc44037e6c8e7003ee3b6d054eee0a5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"b5e1abb181363a4ae665762902c5f5f6601e2e2e","unresolved":false,"context_lines":[{"line_number":260,"context_line":""},{"line_number":261,"context_line":"    def _validate_trusted_issuer(self, env):"},{"line_number":262,"context_line":"        \"\"\"To further filter the certificates that are allowed to participate"},{"line_number":263,"context_line":"        in tokenless authorization. If the config option \u0027trusted_issuer\u0027"},{"line_number":264,"context_line":"        is absent or not containing the trusted issuer DN, no certificates"},{"line_number":265,"context_line":"        will be allowed in tokenless authorization."},{"line_number":266,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"9a80dd14_f7d85555","line":263,"updated":"2015-03-05 07:56:34.000000000","message":"fix up the doc string formatting here,\n\n  \"\"\"one liner summary.\n\n  multi-line comments\n  go here\n  \"\"\"","commit_id":"7ac24a995cc44037e6c8e7003ee3b6d054eee0a5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"b5e1abb181363a4ae665762902c5f5f6601e2e2e","unresolved":false,"context_lines":[{"line_number":285,"context_line":"                      client_issuer, CONF.tokenless_auth.trusted_issuer))"},{"line_number":286,"context_line":"        return False"},{"line_number":287,"context_line":""},{"line_number":288,"context_line":"    def _is_scoped(self, env):"},{"line_number":289,"context_line":"        if \u0027HTTP_X_PROJECT_ID\u0027 in env:"},{"line_number":290,"context_line":"            return True"},{"line_number":291,"context_line":"        elif \u0027HTTP_X_PROJECT_NAME\u0027 in env:"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a80dd14_d7d35136","line":288,"updated":"2015-03-05 07:56:34.000000000","message":"i think this is already covered by _build_scope_info in tokenless_auth.py ?","commit_id":"7ac24a995cc44037e6c8e7003ee3b6d054eee0a5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4b0fd996afa2e2eee6187f6d546a8e4ade94ac4f","unresolved":false,"context_lines":[{"line_number":258,"context_line":""},{"line_number":259,"context_line":"    def _is_tokenless_auth(self, env):"},{"line_number":260,"context_line":"        return (self._validate_trusted_issuer(env) and"},{"line_number":261,"context_line":"                self._is_scoped(env))"},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"    def _validate_trusted_issuer(self, env):"},{"line_number":264,"context_line":"        \"\"\"To further filter the certificates that are trusted."}],"source_content_type":"text/x-python","patch_set":14,"id":"9a80dd14_6647221e","line":261,"updated":"2015-03-06 02:40:33.000000000","message":"this will error out now that _is_scoped was removed","commit_id":"5005addff91905c4e5d8a40bb802023aedfe4153"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"bd27e9a10e8561af76fc045b8a56a4b21eaa1160","unresolved":false,"context_lines":[{"line_number":258,"context_line":""},{"line_number":259,"context_line":"    def _is_tokenless_auth(self, env):"},{"line_number":260,"context_line":"        return (self._validate_trusted_issuer(env) and"},{"line_number":261,"context_line":"                self._is_scoped(env))"},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"    def _validate_trusted_issuer(self, env):"},{"line_number":264,"context_line":"        \"\"\"To further filter the certificates that are trusted."}],"source_content_type":"text/x-python","patch_set":14,"id":"9a80dd14_f572b10f","line":261,"in_reply_to":"9a80dd14_6647221e","updated":"2015-03-06 23:41:31.000000000","message":"good catch, thx","commit_id":"5005addff91905c4e5d8a40bb802023aedfe4153"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"2aa069144e5a41481bd62d675e0efa48e0a737e4","unresolved":false,"context_lines":[{"line_number":295,"context_line":"        # token request API."},{"line_number":296,"context_line":"        path_info \u003d request.environ.get(\u0027PATH_INFO\u0027)"},{"line_number":297,"context_line":"        if (path_info is not None and"},{"line_number":298,"context_line":"                path_info.startswith(\u0027/auth/tokens\u0027) and"},{"line_number":299,"context_line":"                request.environ[\u0027REQUEST_METHOD\u0027] \u003d\u003d \u0027POST\u0027):"},{"line_number":300,"context_line":"            return"},{"line_number":301,"context_line":""}],"source_content_type":"text/x-python","patch_set":21,"id":"baa041b7_fc7762d2","line":298,"updated":"2015-04-02 12:52:41.000000000","message":"This is fairly ugly.  I don\u0027t think we need to explicitly exclude the token path.  Just because the user is validated does not mean they will be able to get a token.","commit_id":"965ba1ea6cb25d1b6fd4620c2e17266c318a6fec"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"386ffe0cf56283202adfa9151e6d2ac07a6f7662","unresolved":false,"context_lines":[{"line_number":295,"context_line":"        # token request API."},{"line_number":296,"context_line":"        path_info \u003d request.environ.get(\u0027PATH_INFO\u0027)"},{"line_number":297,"context_line":"        if (path_info is not None and"},{"line_number":298,"context_line":"                path_info.startswith(\u0027/auth/tokens\u0027) and"},{"line_number":299,"context_line":"                request.environ[\u0027REQUEST_METHOD\u0027] \u003d\u003d \u0027POST\u0027):"},{"line_number":300,"context_line":"            return"},{"line_number":301,"context_line":""}],"source_content_type":"text/x-python","patch_set":21,"id":"baa041b7_4ef65bd8","line":298,"in_reply_to":"baa041b7_fc7762d2","updated":"2015-04-03 22:46:20.000000000","message":"yep, agree on that. Will get that taken care of.","commit_id":"965ba1ea6cb25d1b6fd4620c2e17266c318a6fec"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":235,"context_line":"            LOG.warning(msg)"},{"line_number":236,"context_line":"            return"},{"line_number":237,"context_line":""},{"line_number":238,"context_line":"        auth_context \u003d self._build_auth_context(request)"},{"line_number":239,"context_line":"        LOG.debug(\u0027RBAC: auth_context: %s\u0027, auth_context)"},{"line_number":240,"context_line":"        request.environ[authorization.AUTH_CONTEXT_ENV] \u003d auth_context"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_6896c0f1","side":"PARENT","line":238,"updated":"2015-05-01 15:51:04.000000000","message":"I\u0027d rather build_auth_context was changed to handle the complexity rather than making this method more complex.","commit_id":"13e52952fc98db847de5ed65b9043eb1340dc452"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":235,"context_line":"            LOG.warning(msg)"},{"line_number":236,"context_line":"            return"},{"line_number":237,"context_line":""},{"line_number":238,"context_line":"        auth_context \u003d self._build_auth_context(request)"},{"line_number":239,"context_line":"        LOG.debug(\u0027RBAC: auth_context: %s\u0027, auth_context)"},{"line_number":240,"context_line":"        request.environ[authorization.AUTH_CONTEXT_ENV] \u003d auth_context"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_35ea5510","side":"PARENT","line":238,"in_reply_to":"3acd31a7_6896c0f1","updated":"2015-05-01 21:28:34.000000000","message":"I actually rather to keep it that way unless you have strong objection for that ;-)","commit_id":"13e52952fc98db847de5ed65b9043eb1340dc452"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":230,"context_line":"        \"\"\"Build the authentication context."},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"        The context is built from the attributes provided in the env,"},{"line_number":233,"context_line":"        such as certificate and scope attributes,"},{"line_number":234,"context_line":"        \"\"\""},{"line_number":235,"context_line":"        tokenless_helper \u003d tokenless_auth.TokenlessAuthHelper()"},{"line_number":236,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_28b568ed","line":233,"updated":"2015-05-01 15:51:04.000000000","message":"change , to .","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":242,"context_line":"        token_data \u003d token_helper.get_token_data("},{"line_number":243,"context_line":"            user_id\u003duser_ref[\u0027id\u0027],"},{"line_number":244,"context_line":"            method_names\u003d[CONF.tokenless_auth.protocol],"},{"line_number":245,"context_line":"            extras\u003d{},"},{"line_number":246,"context_line":"            domain_id\u003ddomain_id,"},{"line_number":247,"context_line":"            project_id\u003dproject_id)"},{"line_number":248,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_089d0c59","line":245,"updated":"2015-05-01 15:51:04.000000000","message":"let\u0027s fix this so that you don\u0027t have to pass in extras if there aren\u0027t any.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":242,"context_line":"        token_data \u003d token_helper.get_token_data("},{"line_number":243,"context_line":"            user_id\u003duser_ref[\u0027id\u0027],"},{"line_number":244,"context_line":"            method_names\u003d[CONF.tokenless_auth.protocol],"},{"line_number":245,"context_line":"            extras\u003d{},"},{"line_number":246,"context_line":"            domain_id\u003ddomain_id,"},{"line_number":247,"context_line":"            project_id\u003dproject_id)"},{"line_number":248,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_375140d9","line":245,"in_reply_to":"3acd31a7_089d0c59","updated":"2015-05-01 21:28:34.000000000","message":"it seems like defaults to {}, so I can just take it out :-)","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":260,"context_line":"        \"\"\"To further filter the certificates that are trusted."},{"line_number":261,"context_line":""},{"line_number":262,"context_line":"        If the config option \u0027trusted_issuer\u0027 is absent or not"},{"line_number":263,"context_line":"        containing the trusted issuer DN, no certificates"},{"line_number":264,"context_line":"        will be allowed in tokenless authorization."},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"        :param env: The env contains the client issuer\u0027s attributes"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_88eebcb2","line":263,"updated":"2015-05-01 15:51:04.000000000","message":"change \"not containing\" to \"does not contain\"","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":264,"context_line":"        will be allowed in tokenless authorization."},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"        :param env: The env contains the client issuer\u0027s attributes"},{"line_number":267,"context_line":"        :returns: True is client_issuer is trusted; otherwise False"},{"line_number":268,"context_line":"        \"\"\""},{"line_number":269,"context_line":""},{"line_number":270,"context_line":"        issuer_attribute \u003d CONF.tokenless_auth.issuer_attribute"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_682c8002","line":267,"updated":"2015-05-01 15:51:04.000000000","message":"change \"True is\" to \"True if\"","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":264,"context_line":"        will be allowed in tokenless authorization."},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"        :param env: The env contains the client issuer\u0027s attributes"},{"line_number":267,"context_line":"        :returns: True is client_issuer is trusted; otherwise False"},{"line_number":268,"context_line":"        \"\"\""},{"line_number":269,"context_line":""},{"line_number":270,"context_line":"        issuer_attribute \u003d CONF.tokenless_auth.issuer_attribute"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_d758ccfc","line":267,"in_reply_to":"3acd31a7_682c8002","updated":"2015-05-01 21:28:34.000000000","message":"good catch","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":269,"context_line":""},{"line_number":270,"context_line":"        issuer_attribute \u003d CONF.tokenless_auth.issuer_attribute"},{"line_number":271,"context_line":"        if not issuer_attribute:"},{"line_number":272,"context_line":"            LOG.debug(\u0027Missing issuer attribute\u0027)"},{"line_number":273,"context_line":"            return False"},{"line_number":274,"context_line":""},{"line_number":275,"context_line":"        client_issuer \u003d env.get(issuer_attribute)"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_280d6890","line":272,"updated":"2015-05-01 15:51:04.000000000","message":"This should be a warning and provide enough information so that an admin can fix it.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":269,"context_line":""},{"line_number":270,"context_line":"        issuer_attribute \u003d CONF.tokenless_auth.issuer_attribute"},{"line_number":271,"context_line":"        if not issuer_attribute:"},{"line_number":272,"context_line":"            LOG.debug(\u0027Missing issuer attribute\u0027)"},{"line_number":273,"context_line":"            return False"},{"line_number":274,"context_line":""},{"line_number":275,"context_line":"        client_issuer \u003d env.get(issuer_attribute)"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_576ddc96","line":272,"in_reply_to":"3acd31a7_280d6890","updated":"2015-05-01 21:28:34.000000000","message":"yes, warning is better in this case.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":274,"context_line":""},{"line_number":275,"context_line":"        client_issuer \u003d env.get(issuer_attribute)"},{"line_number":276,"context_line":"        if not client_issuer:"},{"line_number":277,"context_line":"            LOG.debug(\u0027Cannot find client issuer in env.\u0027)"},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"        for trusted_issuer in CONF.tokenless_auth.trusted_issuer:"},{"line_number":280,"context_line":"            if client_issuer \u003d\u003d trusted_issuer:"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_687a40f3","line":277,"updated":"2015-05-01 15:51:04.000000000","message":"is this supposed to return?","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":274,"context_line":""},{"line_number":275,"context_line":"        client_issuer \u003d env.get(issuer_attribute)"},{"line_number":276,"context_line":"        if not client_issuer:"},{"line_number":277,"context_line":"            LOG.debug(\u0027Cannot find client issuer in env.\u0027)"},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"        for trusted_issuer in CONF.tokenless_auth.trusted_issuer:"},{"line_number":280,"context_line":"            if client_issuer \u003d\u003d trusted_issuer:"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_d7268c67","line":277,"in_reply_to":"3acd31a7_687a40f3","updated":"2015-05-01 21:28:34.000000000","message":"good catch, thx","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":276,"context_line":"        if not client_issuer:"},{"line_number":277,"context_line":"            LOG.debug(\u0027Cannot find client issuer in env.\u0027)"},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"        for trusted_issuer in CONF.tokenless_auth.trusted_issuer:"},{"line_number":280,"context_line":"            if client_issuer \u003d\u003d trusted_issuer:"},{"line_number":281,"context_line":"                return True"},{"line_number":282,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_e8277010","line":279,"updated":"2015-05-01 15:51:04.000000000","message":"use issuer_attribute since this code went to the trouble to get it.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":276,"context_line":"        if not client_issuer:"},{"line_number":277,"context_line":"            LOG.debug(\u0027Cannot find client issuer in env.\u0027)"},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"        for trusted_issuer in CONF.tokenless_auth.trusted_issuer:"},{"line_number":280,"context_line":"            if client_issuer \u003d\u003d trusted_issuer:"},{"line_number":281,"context_line":"                return True"},{"line_number":282,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_23c0e229","line":279,"in_reply_to":"3acd31a7_e8277010","updated":"2015-05-01 21:28:34.000000000","message":"This code tries to match the client\u0027s certificate issuer with one of the trusted issuers keystone defined.\n\nissuer_attribute is just the attribute in the env, the value of it is client_issuer.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":282,"context_line":""},{"line_number":283,"context_line":"        LOG.debug(\u0027The client issuer %s does not match with the trusted \u0027"},{"line_number":284,"context_line":"                  \u0027issuer %s\u0027 % ("},{"line_number":285,"context_line":"                      client_issuer, CONF.tokenless_auth.trusted_issuer))"},{"line_number":286,"context_line":"        return False"},{"line_number":287,"context_line":""},{"line_number":288,"context_line":"    def process_request(self, request):"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_c83b9437","line":285,"updated":"2015-05-01 15:51:04.000000000","message":"seems like there should be an audit event for this.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":277,"context_line":""},{"line_number":278,"context_line":"        auth_context \u003d {}"},{"line_number":279,"context_line":"        auth_context[\u0027group_ids\u0027] \u003d user_ref[\u0027group_ids\u0027]"},{"line_number":280,"context_line":"        auth_context[federation.IDENTITY_PROVIDER] \u003d \\"},{"line_number":281,"context_line":"            user_ref[federation.IDENTITY_PROVIDER]"},{"line_number":282,"context_line":"        auth_context[federation.PROTOCOL] \u003d user_ref[federation.PROTOCOL]"},{"line_number":283,"context_line":"        if domain_id:"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_6fd6f3c6","line":280,"updated":"2015-05-13 02:18:51.000000000","message":"use ( to continue a line rather than \\","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":307,"context_line":""},{"line_number":308,"context_line":"        issuer_attribute \u003d CONF.tokenless_auth.issuer_attribute"},{"line_number":309,"context_line":"        if not issuer_attribute:"},{"line_number":310,"context_line":"            LOG.warning(\u0027Missing issuer attribute\u0027)"},{"line_number":311,"context_line":"            return False"},{"line_number":312,"context_line":""},{"line_number":313,"context_line":"        client_issuer \u003d env.get(issuer_attribute)"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_8fe8077e","line":310,"updated":"2015-05-13 02:18:51.000000000","message":"the string needs to be marked for translation, using _LW()\n\nthe message needs to provide enough information so that the reader will know what to do.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"7e506bafe89392ced44a8aafe46be1e6d47dfe68","unresolved":false,"context_lines":[{"line_number":307,"context_line":""},{"line_number":308,"context_line":"        issuer_attribute \u003d CONF.tokenless_auth.issuer_attribute"},{"line_number":309,"context_line":"        if not issuer_attribute:"},{"line_number":310,"context_line":"            LOG.warning(\u0027Missing issuer attribute\u0027)"},{"line_number":311,"context_line":"            return False"},{"line_number":312,"context_line":""},{"line_number":313,"context_line":"        client_issuer \u003d env.get(issuer_attribute)"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_cea257ae","line":310,"in_reply_to":"9a0c5dc1_8fe8077e","updated":"2015-05-14 00:14:45.000000000","message":"that config option defaults to SSL_CLIENT_I_DN, so there is actually no need for this validation.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":315,"context_line":"            LOG.debug(\u0027Cannot find client issuer in env.\u0027)"},{"line_number":316,"context_line":"            return False"},{"line_number":317,"context_line":""},{"line_number":318,"context_line":"        for trusted_issuer in CONF.tokenless_auth.trusted_issuer:"},{"line_number":319,"context_line":"            if client_issuer \u003d\u003d trusted_issuer:"},{"line_number":320,"context_line":"                return True"},{"line_number":321,"context_line":""}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_eff9c34e","line":318,"updated":"2015-05-13 02:18:51.000000000","message":"I don\u0027t understand the response to my comment in patch set 3... line 308 has \"issuer_attribute \u003d CONF.tokenless_auth.issuer_attribute\", so CONF.tokenless_auth.trusted_issuer can be replaced with issuer_attribute here.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"7e506bafe89392ced44a8aafe46be1e6d47dfe68","unresolved":false,"context_lines":[{"line_number":315,"context_line":"            LOG.debug(\u0027Cannot find client issuer in env.\u0027)"},{"line_number":316,"context_line":"            return False"},{"line_number":317,"context_line":""},{"line_number":318,"context_line":"        for trusted_issuer in CONF.tokenless_auth.trusted_issuer:"},{"line_number":319,"context_line":"            if client_issuer \u003d\u003d trusted_issuer:"},{"line_number":320,"context_line":"                return True"},{"line_number":321,"context_line":""}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_917da070","line":318,"in_reply_to":"9a0c5dc1_eff9c34e","updated":"2015-05-14 00:14:45.000000000","message":"ok, sorry for the confusion here. what it basically does here is to:\n1. find the Issuer(client_issuer) from the client certificate referenced from env by \"CONF.tokenless_auth.issuer_attribute\"(SSL_CLIENT_I_DN)\n2. compare the Issuer(client_isser) if it matches with one of the trusted issuers defined in keystone.conf as the option \u0027trusted_issuer\u0027\n\nSSL_CLIENT_I_DN is always the attribute name in the env that references to the certificate\u0027s Issuer.\n\nFor example:\nenv \u003d { ...\n           \"SSL_CLIENT_I_DN\": \"CN\u003djohn,OU\u003dkeystone,O\u003dopenstack\"\n           ....\n          }\n\nkeystone.conf has the following defined:\ntrusted_isser\u003dCN\u003djohn,OU\u003dkeystone,O\u003dopenstack\ntrusted_isser\u003dCN\u003dmary,OU\u003deng,O\u003dabc\n\nthe client_issuer is trusted as it matches with an entry in keystone.conf.\n\nhope this clears the confusion.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":321,"context_line":""},{"line_number":322,"context_line":"        LOG.debug(\u0027The client issuer %s does not match with the trusted \u0027"},{"line_number":323,"context_line":"                  \u0027issuer %s\u0027 % ("},{"line_number":324,"context_line":"                      client_issuer, CONF.tokenless_auth.trusted_issuer))"},{"line_number":325,"context_line":"        return False"},{"line_number":326,"context_line":""},{"line_number":327,"context_line":"    def process_request(self, request):"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_8f9fe702","line":324,"updated":"2015-05-13 02:18:51.000000000","message":"there should be an audit event for this.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":326,"context_line":""},{"line_number":327,"context_line":"    def process_request(self, request):"},{"line_number":328,"context_line":"        if authorization.AUTH_CONTEXT_ENV in request.environ:"},{"line_number":329,"context_line":"            msg \u003d _LW(\u0027Auth context already exists in the request environment\u0027)"},{"line_number":330,"context_line":"            LOG.warning(msg)"},{"line_number":331,"context_line":"            return"},{"line_number":332,"context_line":""}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_4f8a0fc1","line":329,"updated":"2015-05-13 02:18:51.000000000","message":"the message should say what the admin is supposed to do about this.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"963cafb3de73d44b73365724f8150468f808bc9a","unresolved":false,"context_lines":[{"line_number":26,"context_line":"from keystone import exception"},{"line_number":27,"context_line":"from keystone.i18n import _LW"},{"line_number":28,"context_line":"from keystone.models import token_model"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"from keystone import notifications"},{"line_number":31,"context_line":"from keystone.token.providers import common"},{"line_number":32,"context_line":""}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_7f8e1d2f","line":29,"updated":"2015-07-15 19:04:40.000000000","message":"group these together","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"635a96eca050e869fe5b34400a865f622f9bb5bd","unresolved":false,"context_lines":[{"line_number":26,"context_line":"from keystone import exception"},{"line_number":27,"context_line":"from keystone.i18n import _LW"},{"line_number":28,"context_line":"from keystone.models import token_model"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"from keystone import notifications"},{"line_number":31,"context_line":"from keystone.token.providers import common"},{"line_number":32,"context_line":""}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_bf002503","line":29,"in_reply_to":"9a41bdd9_7f8e1d2f","updated":"2015-07-15 19:40:29.000000000","message":"done","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"a2cab849c5e8441c44c399393084b3484b548c58","unresolved":false,"context_lines":[{"line_number":281,"context_line":"                return True"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":"        LOG.debug(\u0027The client issuer %s does not match with the trusted \u0027"},{"line_number":284,"context_line":"                  \u0027issuer %s\u0027 % ("},{"line_number":285,"context_line":"                      client_issuer, CONF.tokenless_auth.trusted_issuer))"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"        # An audit event"}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_820aaa88","line":284,"updated":"2015-07-15 19:57:47.000000000","message":"no %!","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"8ada87ee5b062ac22c3cd494fd285e3982f06c4e","unresolved":false,"context_lines":[{"line_number":281,"context_line":"                return True"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":"        LOG.debug(\u0027The client issuer %s does not match with the trusted \u0027"},{"line_number":284,"context_line":"                  \u0027issuer %s\u0027 % ("},{"line_number":285,"context_line":"                      client_issuer, CONF.tokenless_auth.trusted_issuer))"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"        # An audit event"}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_0ec9e1ab","line":284,"in_reply_to":"9a41bdd9_820aaa88","updated":"2015-07-16 02:50:56.000000000","message":"done","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"963cafb3de73d44b73365724f8150468f808bc9a","unresolved":false,"context_lines":[{"line_number":292,"context_line":"                                    client_issuer, initiator)"},{"line_number":293,"context_line":"        return False"},{"line_number":294,"context_line":""},{"line_number":295,"context_line":"    def process_request(self, request):"},{"line_number":296,"context_line":"        if authorization.AUTH_CONTEXT_ENV in request.environ:"},{"line_number":297,"context_line":"            msg \u003d _LW(\u0027Auth context already exists in the request \u0027"},{"line_number":298,"context_line":"                      \u0027environment; it will be used for authorization \u0027"}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_3f841509","line":295,"updated":"2015-07-15 19:04:40.000000000","message":"add comments here","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"635a96eca050e869fe5b34400a865f622f9bb5bd","unresolved":false,"context_lines":[{"line_number":292,"context_line":"                                    client_issuer, initiator)"},{"line_number":293,"context_line":"        return False"},{"line_number":294,"context_line":""},{"line_number":295,"context_line":"    def process_request(self, request):"},{"line_number":296,"context_line":"        if authorization.AUTH_CONTEXT_ENV in request.environ:"},{"line_number":297,"context_line":"            msg \u003d _LW(\u0027Auth context already exists in the request \u0027"},{"line_number":298,"context_line":"                      \u0027environment; it will be used for authorization \u0027"}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_42b82275","line":295,"in_reply_to":"9a41bdd9_3f841509","updated":"2015-07-15 19:40:29.000000000","message":"will do","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"e64ac0161dad0f25fd7011c9e24a4fa1a3242680","unresolved":false,"context_lines":[{"line_number":275,"context_line":"            LOG.debug(\u0027Cannot find client issuer in env.\u0027)"},{"line_number":276,"context_line":"            return False"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"        for trusted_issuer in CONF.tokenless_auth.trusted_issuer:"},{"line_number":279,"context_line":"            if client_issuer \u003d\u003d trusted_issuer:"},{"line_number":280,"context_line":"                return True"},{"line_number":281,"context_line":""}],"source_content_type":"text/x-python","patch_set":40,"id":"9a41bdd9_16e2f79f","line":278,"updated":"2015-07-17 13:45:41.000000000","message":"this seems to be not tested. I would like to see a test that would show that with provided issuer_attribute not in trusted_issuer list validation fails.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"2c33ae916ebbd68fd732974243450f94e2f78b05","unresolved":false,"context_lines":[{"line_number":275,"context_line":"            LOG.debug(\u0027Cannot find client issuer in env.\u0027)"},{"line_number":276,"context_line":"            return False"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"        for trusted_issuer in CONF.tokenless_auth.trusted_issuer:"},{"line_number":279,"context_line":"            if client_issuer \u003d\u003d trusted_issuer:"},{"line_number":280,"context_line":"                return True"},{"line_number":281,"context_line":""}],"source_content_type":"text/x-python","patch_set":40,"id":"3a50d1a3_5ddc1712","line":278,"in_reply_to":"3a50d1a3_0c07511d","updated":"2015-07-21 00:28:29.000000000","message":"this actually has already been in test \u0027test_client_issuer_not_trusted\u0027","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"c96b984cb110bd0df4fb322c0657686604287e88","unresolved":false,"context_lines":[{"line_number":275,"context_line":"            LOG.debug(\u0027Cannot find client issuer in env.\u0027)"},{"line_number":276,"context_line":"            return False"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"        for trusted_issuer in CONF.tokenless_auth.trusted_issuer:"},{"line_number":279,"context_line":"            if client_issuer \u003d\u003d trusted_issuer:"},{"line_number":280,"context_line":"                return True"},{"line_number":281,"context_line":""}],"source_content_type":"text/x-python","patch_set":40,"id":"3a50d1a3_0c07511d","line":278,"in_reply_to":"9a41bdd9_16e2f79f","updated":"2015-07-20 18:56:00.000000000","message":"will have it included","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"e64ac0161dad0f25fd7011c9e24a4fa1a3242680","unresolved":false,"context_lines":[{"line_number":276,"context_line":"            return False"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"        for trusted_issuer in CONF.tokenless_auth.trusted_issuer:"},{"line_number":279,"context_line":"            if client_issuer \u003d\u003d trusted_issuer:"},{"line_number":280,"context_line":"                return True"},{"line_number":281,"context_line":""},{"line_number":282,"context_line":"        LOG.debug(\u0027The client issuer %s does not match with the trusted \u0027"}],"source_content_type":"text/x-python","patch_set":40,"id":"9a41bdd9_56ff1f34","line":279,"updated":"2015-07-17 13:45:41.000000000","message":"the loop should be replaced with \"if client_issuer in CONF.tokenless_auth.trusted_issuer: return True\".","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"c96b984cb110bd0df4fb322c0657686604287e88","unresolved":false,"context_lines":[{"line_number":276,"context_line":"            return False"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"        for trusted_issuer in CONF.tokenless_auth.trusted_issuer:"},{"line_number":279,"context_line":"            if client_issuer \u003d\u003d trusted_issuer:"},{"line_number":280,"context_line":"                return True"},{"line_number":281,"context_line":""},{"line_number":282,"context_line":"        LOG.debug(\u0027The client issuer %s does not match with the trusted \u0027"}],"source_content_type":"text/x-python","patch_set":40,"id":"3a50d1a3_4769b2bd","line":279,"in_reply_to":"9a41bdd9_56ff1f34","updated":"2015-07-20 18:56:00.000000000","message":"you got it.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"e64ac0161dad0f25fd7011c9e24a4fa1a3242680","unresolved":false,"context_lines":[{"line_number":317,"context_line":"                auth_context \u003d self._build_tokenless_auth_context("},{"line_number":318,"context_line":"                    request.environ)"},{"line_number":319,"context_line":"        else:"},{"line_number":320,"context_line":"            return"},{"line_number":321,"context_line":"        LOG.debug(\u0027RBAC: auth_context: %s\u0027, auth_context)"},{"line_number":322,"context_line":"        request.environ[authorization.AUTH_CONTEXT_ENV] \u003d auth_context"}],"source_content_type":"text/x-python","patch_set":40,"id":"9a41bdd9_39136c5e","line":320,"updated":"2015-07-17 13:45:41.000000000","message":"Sorry for probably dumb question, but should not we raise Unauthorized exception here if neither token nor client certificate was provided? Before the change _build_auth_context() would raise that exception if the token is wrong. However, the tests are passing...","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"2c33ae916ebbd68fd732974243450f94e2f78b05","unresolved":false,"context_lines":[{"line_number":317,"context_line":"                auth_context \u003d self._build_tokenless_auth_context("},{"line_number":318,"context_line":"                    request.environ)"},{"line_number":319,"context_line":"        else:"},{"line_number":320,"context_line":"            return"},{"line_number":321,"context_line":"        LOG.debug(\u0027RBAC: auth_context: %s\u0027, auth_context)"},{"line_number":322,"context_line":"        request.environ[authorization.AUTH_CONTEXT_ENV] \u003d auth_context"}],"source_content_type":"text/x-python","patch_set":40,"id":"3a50d1a3_e820c39d","line":320,"in_reply_to":"3a50d1a3_99b95eec","updated":"2015-07-21 00:28:29.000000000","message":"shoot, I overlooked my own code! what I have there is fine. request.environ will be set when if or elif block satisfies. Else, it will return.\nAnd the reason that it does not raise exception remains the same reason that I stated from my previous comment. This module does not set the request.environ, that leaves the chance for the other modules in the pipeline to set it up. Or the request will not be authorized eventually if noone sets it up.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"c96b984cb110bd0df4fb322c0657686604287e88","unresolved":false,"context_lines":[{"line_number":317,"context_line":"                auth_context \u003d self._build_tokenless_auth_context("},{"line_number":318,"context_line":"                    request.environ)"},{"line_number":319,"context_line":"        else:"},{"line_number":320,"context_line":"            return"},{"line_number":321,"context_line":"        LOG.debug(\u0027RBAC: auth_context: %s\u0027, auth_context)"},{"line_number":322,"context_line":"        request.environ[authorization.AUTH_CONTEXT_ENV] \u003d auth_context"}],"source_content_type":"text/x-python","patch_set":40,"id":"3a50d1a3_99b95eec","line":320,"in_reply_to":"9a41bdd9_39136c5e","updated":"2015-07-20 18:56:00.000000000","message":"that\u0027s a good question, the last line will not be reached and that should have been in the if and elif blocks.\nThere should be no exception raised as it is one of the modules in the pipline, if a AUTH_CONTEXT_ENV is not set here, it will try the rest of modules in the pipline. but why it\u0027s passing the tests, I will need to take another look at it.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"436d78ae83b92b85e2b4146cbbabb7ec0592352f","unresolved":false,"context_lines":[{"line_number":22,"context_line":"from keystone.common import authorization"},{"line_number":23,"context_line":"from keystone.common import tokenless_auth"},{"line_number":24,"context_line":"from keystone.common import wsgi"},{"line_number":25,"context_line":"from keystone.contrib.federation import constants"},{"line_number":26,"context_line":"from keystone import exception"},{"line_number":27,"context_line":"from keystone.i18n import _LW"},{"line_number":28,"context_line":"from keystone.models import token_model"}],"source_content_type":"text/x-python","patch_set":43,"id":"3a50d1a3_41968295","line":25,"updated":"2015-07-24 18:07:37.000000000","message":"everywhere else it is used as federation_constants","commit_id":"d05acbf5007f932b41cd36e28575f238e046f332"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"8821e4475aecd947fda8b09b33d1a80c6f865357","unresolved":false,"context_lines":[{"line_number":22,"context_line":"from keystone.common import authorization"},{"line_number":23,"context_line":"from keystone.common import tokenless_auth"},{"line_number":24,"context_line":"from keystone.common import wsgi"},{"line_number":25,"context_line":"from keystone.contrib.federation import constants"},{"line_number":26,"context_line":"from keystone import exception"},{"line_number":27,"context_line":"from keystone.i18n import _LW"},{"line_number":28,"context_line":"from keystone.models import token_model"}],"source_content_type":"text/x-python","patch_set":43,"id":"3a50d1a3_9ecffcb2","line":25,"in_reply_to":"3a50d1a3_41968295","updated":"2015-07-24 22:21:47.000000000","message":"yep, you got it!","commit_id":"d05acbf5007f932b41cd36e28575f238e046f332"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"99a8e51e8bba3291f7b20118fe500016df0ab8ac","unresolved":false,"context_lines":[{"line_number":316,"context_line":"            else:"},{"line_number":317,"context_line":"                auth_context \u003d self._build_tokenless_auth_context("},{"line_number":318,"context_line":"                    request.environ)"},{"line_number":319,"context_line":"        else:"},{"line_number":320,"context_line":"            return"},{"line_number":321,"context_line":"        LOG.debug(\u0027RBAC: auth_context: %s\u0027, auth_context)"},{"line_number":322,"context_line":"        request.environ[authorization.AUTH_CONTEXT_ENV] \u003d auth_context"}],"source_content_type":"text/x-python","patch_set":47,"id":"3a50d1a3_121c4e69","line":319,"updated":"2015-07-30 19:16:53.000000000","message":"would be useful to add a debug here too to determine that the request cannot be processed","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"288bb4dade83c0212c1f9f86638d0843b09cae40","unresolved":false,"context_lines":[{"line_number":316,"context_line":"            else:"},{"line_number":317,"context_line":"                auth_context \u003d self._build_tokenless_auth_context("},{"line_number":318,"context_line":"                    request.environ)"},{"line_number":319,"context_line":"        else:"},{"line_number":320,"context_line":"            return"},{"line_number":321,"context_line":"        LOG.debug(\u0027RBAC: auth_context: %s\u0027, auth_context)"},{"line_number":322,"context_line":"        request.environ[authorization.AUTH_CONTEXT_ENV] \u003d auth_context"}],"source_content_type":"text/x-python","patch_set":47,"id":"3a50d1a3_f3196b23","line":319,"in_reply_to":"3a50d1a3_121c4e69","updated":"2015-07-31 21:31:31.000000000","message":"that\u0027s good idea! done.","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"108d338748c84d9499fea73c4b144151d1c59b05","unresolved":false,"context_lines":[{"line_number":304,"context_line":"        # behavior. Tokenless authorization with X.509 SSL client"},{"line_number":305,"context_line":"        # certificate is effectively disabled if no trusted issuers are"},{"line_number":306,"context_line":"        # provided."},{"line_number":307,"context_line":"        if AUTH_TOKEN_HEADER in request.headers:"},{"line_number":308,"context_line":"            auth_context \u003d self._build_auth_context(request)"},{"line_number":309,"context_line":"        elif self._validate_trusted_issuer(request.environ):"},{"line_number":310,"context_line":"            if CONF.tokenless_auth.ephemeral_user:"}],"source_content_type":"text/x-python","patch_set":48,"id":"1a4dcd0f_afbd5cd9","line":307,"updated":"2015-08-06 17:44:35.000000000","message":"AUTH_TOKEN_HEADER is not set when user tries to authenticate using his username/password","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"cf794506f5cec679247e50d8e9a372e32b3a903c","unresolved":false,"context_lines":[{"line_number":304,"context_line":"        # behavior. Tokenless authorization with X.509 SSL client"},{"line_number":305,"context_line":"        # certificate is effectively disabled if no trusted issuers are"},{"line_number":306,"context_line":"        # provided."},{"line_number":307,"context_line":"        if AUTH_TOKEN_HEADER in request.headers:"},{"line_number":308,"context_line":"            auth_context \u003d self._build_auth_context(request)"},{"line_number":309,"context_line":"        elif self._validate_trusted_issuer(request.environ):"},{"line_number":310,"context_line":"            if CONF.tokenless_auth.ephemeral_user:"}],"source_content_type":"text/x-python","patch_set":48,"id":"1a4dcd0f_ef760405","line":307,"in_reply_to":"1a4dcd0f_afbd5cd9","updated":"2015-08-06 17:59:15.000000000","message":"This pipeline is for token validate, so if you did not have your auth_token_header nor x509, it will just move on to the rest of the module in the pipeline. And most likely it will fail for the authentication.\nWhen you provide username/password for a token, it will be in a different route, not coming to here.","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"a52a3138a0e5f8cfc40a20f990e825a9c5927ef1","unresolved":false,"context_lines":[{"line_number":304,"context_line":"        # behavior. Tokenless authorization with X.509 SSL client"},{"line_number":305,"context_line":"        # certificate is effectively disabled if no trusted issuers are"},{"line_number":306,"context_line":"        # provided."},{"line_number":307,"context_line":"        if AUTH_TOKEN_HEADER in request.headers:"},{"line_number":308,"context_line":"            auth_context \u003d self._build_auth_context(request)"},{"line_number":309,"context_line":"        elif self._validate_trusted_issuer(request.environ):"},{"line_number":310,"context_line":"            if CONF.tokenless_auth.ephemeral_user:"}],"source_content_type":"text/x-python","patch_set":48,"id":"1a4dcd0f_6298cb6a","line":307,"in_reply_to":"1a4dcd0f_ef760405","updated":"2015-08-06 18:09:04.000000000","message":"you are right, sorry.","commit_id":"f1ffe7bd73d4b6c438d19b41a7feef2c0222a83e"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"960cb80720283eef0de77234e758267eb90a2d3d","unresolved":false,"context_lines":[{"line_number":273,"context_line":""},{"line_number":274,"context_line":"        client_issuer \u003d env.get(CONF.tokenless_auth.issuer_attribute)"},{"line_number":275,"context_line":"        if not client_issuer:"},{"line_number":276,"context_line":"            LOG.debug(\u0027Cannot find client issuer in env.\u0027)"},{"line_number":277,"context_line":"            return False"},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"        if client_issuer in CONF.tokenless_auth.trusted_issuer:"}],"source_content_type":"text/x-python","patch_set":50,"id":"fa1b9901_fba5a0a1","line":276,"updated":"2015-08-20 02:12:44.000000000","message":"might be good to include the value of \"issuer_attribute\" too in the log","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5c35fe32e246aaf52a8f5de28d61a87faea3a722","unresolved":false,"context_lines":[{"line_number":273,"context_line":""},{"line_number":274,"context_line":"        client_issuer \u003d env.get(CONF.tokenless_auth.issuer_attribute)"},{"line_number":275,"context_line":"        if not client_issuer:"},{"line_number":276,"context_line":"            LOG.debug(\u0027Cannot find client issuer in env.\u0027)"},{"line_number":277,"context_line":"            return False"},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"        if client_issuer in CONF.tokenless_auth.trusted_issuer:"}],"source_content_type":"text/x-python","patch_set":50,"id":"fa1b9901_9abd3704","line":276,"in_reply_to":"fa1b9901_fba5a0a1","updated":"2015-08-21 01:19:55.000000000","message":"done","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"960cb80720283eef0de77234e758267eb90a2d3d","unresolved":false,"context_lines":[{"line_number":315,"context_line":"                    request.environ)"},{"line_number":316,"context_line":"            else:"},{"line_number":317,"context_line":"                auth_context \u003d self._build_tokenless_auth_context("},{"line_number":318,"context_line":"                    request.environ)"},{"line_number":319,"context_line":"        else:"},{"line_number":320,"context_line":"            LOG.debug(\u0027There is either no auth token in the request or \u0027"},{"line_number":321,"context_line":"                      \u0027the certificate issuer in the Tokenless auth is \u0027"}],"source_content_type":"text/x-python","patch_set":50,"id":"fa1b9901_f31e19ba","line":318,"updated":"2015-08-20 02:12:44.000000000","message":"should this generate a cadf notification for success/fail of x509 authentication?\n\nhttps://github.com/openstack/keystone/blob/master/keystone/notifications.py#L544-L552","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5c35fe32e246aaf52a8f5de28d61a87faea3a722","unresolved":false,"context_lines":[{"line_number":315,"context_line":"                    request.environ)"},{"line_number":316,"context_line":"            else:"},{"line_number":317,"context_line":"                auth_context \u003d self._build_tokenless_auth_context("},{"line_number":318,"context_line":"                    request.environ)"},{"line_number":319,"context_line":"        else:"},{"line_number":320,"context_line":"            LOG.debug(\u0027There is either no auth token in the request or \u0027"},{"line_number":321,"context_line":"                      \u0027the certificate issuer in the Tokenless auth is \u0027"}],"source_content_type":"text/x-python","patch_set":50,"id":"fa1b9901_55e0d0cc","line":318,"in_reply_to":"fa1b9901_f31e19ba","updated":"2015-08-21 01:19:55.000000000","message":"In the method _validate_trusted_issuer(), it has already triggered a notification if the client issuer is not trusted. \nAnd I think it\u0027s unnecessary to trigger another notification here as the underneath API will handle/report the error if something happens while building the auth context.","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18e1f6d929399c37afba2d62f138238541c71973","unresolved":false,"context_lines":[{"line_number":290,"context_line":"            LOG.warning(msg)"},{"line_number":291,"context_line":"            return"},{"line_number":292,"context_line":""},{"line_number":293,"context_line":"        # NOTE(gyee): token take precedence over SSL client certificate."},{"line_number":294,"context_line":"        # This will preserve backward compatibility with the existing"},{"line_number":295,"context_line":"        # behavior. Tokenless authorization with X.509 SSL client"},{"line_number":296,"context_line":"        # certificate is effectively disabled if no trusted issuers are"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_659c116a","line":293,"updated":"2015-08-26 18:34:25.000000000","message":"takes* certificates*","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18e1f6d929399c37afba2d62f138238541c71973","unresolved":false,"context_lines":[{"line_number":303,"context_line":"        else:"},{"line_number":304,"context_line":"            LOG.debug(\u0027There is either no auth token in the request or \u0027"},{"line_number":305,"context_line":"                      \u0027the certificate issuer in the Tokenless auth is \u0027"},{"line_number":306,"context_line":"                      \u0027not trusted. No auth context will be set.\u0027)"},{"line_number":307,"context_line":"            return"},{"line_number":308,"context_line":"        LOG.debug(\u0027RBAC: auth_context: %s\u0027, auth_context)"},{"line_number":309,"context_line":"        request.environ[authorization.AUTH_CONTEXT_ENV] \u003d auth_context"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_857cc521","line":306,"updated":"2015-08-26 18:34:25.000000000","message":"should an exception be raised here?","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5a38c16026ca6a7252db7a0c48d38dd29ef7e852","unresolved":false,"context_lines":[{"line_number":303,"context_line":"        else:"},{"line_number":304,"context_line":"            LOG.debug(\u0027There is either no auth token in the request or \u0027"},{"line_number":305,"context_line":"                      \u0027the certificate issuer in the Tokenless auth is \u0027"},{"line_number":306,"context_line":"                      \u0027not trusted. No auth context will be set.\u0027)"},{"line_number":307,"context_line":"            return"},{"line_number":308,"context_line":"        LOG.debug(\u0027RBAC: auth_context: %s\u0027, auth_context)"},{"line_number":309,"context_line":"        request.environ[authorization.AUTH_CONTEXT_ENV] \u003d auth_context"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_a42c59ac","line":306,"in_reply_to":"da20952f_857cc521","updated":"2015-08-27 03:51:32.000000000","message":"exception should not be raised here. we just don\u0027t set auth context in the module, but we will let the request go on to the other modules in the pipeline.","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d338bea3e6ae19a1c958d7d99347292a831b7bb3","unresolved":false,"context_lines":[{"line_number":28,"context_line":"from keystone.models import token_model"},{"line_number":29,"context_line":"from keystone import notifications"},{"line_number":30,"context_line":"from keystone.token.providers import common"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"CONF \u003d cfg.CONF"},{"line_number":33,"context_line":"LOG \u003d log.getLogger(__name__)"},{"line_number":34,"context_line":""}],"source_content_type":"text/x-python","patch_set":56,"id":"da20952f_b89b03c9","line":31,"updated":"2015-08-27 13:34:49.000000000","message":"Missing a newline","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"019cbb1766bd174d043356f6de9920ffb207767e","unresolved":false,"context_lines":[{"line_number":28,"context_line":"from keystone.models import token_model"},{"line_number":29,"context_line":"from keystone import notifications"},{"line_number":30,"context_line":"from keystone.token.providers import common"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"CONF \u003d cfg.CONF"},{"line_number":33,"context_line":"LOG \u003d log.getLogger(__name__)"},{"line_number":34,"context_line":""}],"source_content_type":"text/x-python","patch_set":56,"id":"da20952f_f6441e75","line":31,"in_reply_to":"da20952f_b89b03c9","updated":"2015-08-27 18:19:47.000000000","message":"done","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d338bea3e6ae19a1c958d7d99347292a831b7bb3","unresolved":false,"context_lines":[{"line_number":261,"context_line":""},{"line_number":262,"context_line":"        client_issuer \u003d env.get(CONF.tokenless_auth.issuer_attribute)"},{"line_number":263,"context_line":"        if not client_issuer:"},{"line_number":264,"context_line":"            LOG.debug(\u0027Cannot find client issuer in env by the \u0027"},{"line_number":265,"context_line":"                      \u0027issuer attribute - %s.\u0027 %"},{"line_number":266,"context_line":"                      CONF.tokenless_auth.issuer_attribute)"},{"line_number":267,"context_line":"            return False"}],"source_content_type":"text/x-python","patch_set":56,"id":"da20952f_f8f17bce","line":264,"updated":"2015-08-27 13:34:49.000000000","message":"It seems like this would be important for operators to see, so debug probably isn\u0027t right","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"019cbb1766bd174d043356f6de9920ffb207767e","unresolved":false,"context_lines":[{"line_number":261,"context_line":""},{"line_number":262,"context_line":"        client_issuer \u003d env.get(CONF.tokenless_auth.issuer_attribute)"},{"line_number":263,"context_line":"        if not client_issuer:"},{"line_number":264,"context_line":"            LOG.debug(\u0027Cannot find client issuer in env by the \u0027"},{"line_number":265,"context_line":"                      \u0027issuer attribute - %s.\u0027 %"},{"line_number":266,"context_line":"                      CONF.tokenless_auth.issuer_attribute)"},{"line_number":267,"context_line":"            return False"}],"source_content_type":"text/x-python","patch_set":56,"id":"da20952f_6a2a5e80","line":264,"in_reply_to":"da20952f_f8f17bce","updated":"2015-08-27 18:19:47.000000000","message":"sure, will log it as warning.","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d338bea3e6ae19a1c958d7d99347292a831b7bb3","unresolved":false,"context_lines":[{"line_number":269,"context_line":"        if client_issuer in CONF.tokenless_auth.trusted_issuer:"},{"line_number":270,"context_line":"            return True"},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"        LOG.debug(\u0027The client issuer %s does not match with the trusted \u0027"},{"line_number":273,"context_line":"                  \u0027issuer %s\u0027,"},{"line_number":274,"context_line":"                  client_issuer, CONF.tokenless_auth.trusted_issuer)"},{"line_number":275,"context_line":""}],"source_content_type":"text/x-python","patch_set":56,"id":"da20952f_d8a6f7c0","line":272,"updated":"2015-08-27 13:34:49.000000000","message":"Same here","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"019cbb1766bd174d043356f6de9920ffb207767e","unresolved":false,"context_lines":[{"line_number":269,"context_line":"        if client_issuer in CONF.tokenless_auth.trusted_issuer:"},{"line_number":270,"context_line":"            return True"},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"        LOG.debug(\u0027The client issuer %s does not match with the trusted \u0027"},{"line_number":273,"context_line":"                  \u0027issuer %s\u0027,"},{"line_number":274,"context_line":"                  client_issuer, CONF.tokenless_auth.trusted_issuer)"},{"line_number":275,"context_line":""}],"source_content_type":"text/x-python","patch_set":56,"id":"da20952f_aa3076e9","line":272,"in_reply_to":"da20952f_d8a6f7c0","updated":"2015-08-27 18:19:47.000000000","message":"sure, will be a warning.","commit_id":"9bacabed509045f4202419ba95d322739fd707e2"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"d075a9f2d6a8687e4041eac4d67a79a8c35fc0e7","unresolved":false,"context_lines":[{"line_number":227,"context_line":"            if domain_id:"},{"line_number":228,"context_line":"                auth_context[\u0027domain_id\u0027] \u003d domain_id"},{"line_number":229,"context_line":"            if project_id:"},{"line_number":230,"context_line":"                auth_context[\u0027project_id\u0027] \u003d project_id"},{"line_number":231,"context_line":"            auth_context[\u0027roles\u0027] \u003d user_ref[\u0027roles\u0027]"},{"line_number":232,"context_line":"            return auth_context"},{"line_number":233,"context_line":""}],"source_content_type":"text/x-python","patch_set":58,"id":"da20952f_de5b8784","line":230,"updated":"2015-09-01 10:09:07.000000000","message":"what if both domain_id and project_id are set? We cannot scope to both, can we?","commit_id":"3c01f8762855e47f34823b76f5fd4a8780704718"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"050cbc134e73e5936cdeccb4b2539246dff687cc","unresolved":false,"context_lines":[{"line_number":227,"context_line":"            if domain_id:"},{"line_number":228,"context_line":"                auth_context[\u0027domain_id\u0027] \u003d domain_id"},{"line_number":229,"context_line":"            if project_id:"},{"line_number":230,"context_line":"                auth_context[\u0027project_id\u0027] \u003d project_id"},{"line_number":231,"context_line":"            auth_context[\u0027roles\u0027] \u003d user_ref[\u0027roles\u0027]"},{"line_number":232,"context_line":"            return auth_context"},{"line_number":233,"context_line":""}],"source_content_type":"text/x-python","patch_set":58,"id":"da20952f_3f87f413","line":230,"in_reply_to":"da20952f_de5b8784","updated":"2015-09-01 23:56:19.000000000","message":"Yeah, they should be mutually exclusive. We need to raise an exception here.","commit_id":"3c01f8762855e47f34823b76f5fd4a8780704718"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"b73ef343145505abddc850b642106be5b2b6b7cb","unresolved":false,"context_lines":[{"line_number":227,"context_line":"            if domain_id:"},{"line_number":228,"context_line":"                auth_context[\u0027domain_id\u0027] \u003d domain_id"},{"line_number":229,"context_line":"            if project_id:"},{"line_number":230,"context_line":"                auth_context[\u0027project_id\u0027] \u003d project_id"},{"line_number":231,"context_line":"            auth_context[\u0027roles\u0027] \u003d user_ref[\u0027roles\u0027]"},{"line_number":232,"context_line":"            return auth_context"},{"line_number":233,"context_line":""}],"source_content_type":"text/x-python","patch_set":58,"id":"da20952f_3f9a94c6","line":230,"in_reply_to":"da20952f_de5b8784","updated":"2015-09-02 00:09:20.000000000","message":"done","commit_id":"3c01f8762855e47f34823b76f5fd4a8780704718"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"d075a9f2d6a8687e4041eac4d67a79a8c35fc0e7","unresolved":false,"context_lines":[{"line_number":248,"context_line":"        auth_context[\u0027roles\u0027] \u003d [role[\u0027name\u0027] for role"},{"line_number":249,"context_line":"                                 in token_data[\u0027token\u0027][\u0027roles\u0027]]"},{"line_number":250,"context_line":"        return auth_context"},{"line_number":251,"context_line":""},{"line_number":252,"context_line":"    def _validate_trusted_issuer(self, env):"},{"line_number":253,"context_line":"        \"\"\"To further filter the certificates that are trusted."},{"line_number":254,"context_line":""}],"source_content_type":"text/x-python","patch_set":58,"id":"da20952f_848cdeda","line":251,"updated":"2015-09-01 10:09:07.000000000","message":"I think I see what you are doing - so you want to authenticate and authorize user at this early stage because the whole call (I deducted this from the curl -X GET keystone/v3/auth/tokens example in the doc) is a token validation, so you must provide a token to validate.\n\nWhat is we used cul -X POST /auth/tokens with the certificate, and in the AuthContextMiddleware simply build a json object so it looks like it was a federation request - something like this: https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/controllers.py#L280\n\nPlease, explain if I am missing something :-)\nP.S. Looking at the class name (AuthCoontextMiddleware) and the place where it is called in the pipe, it\u0027s purpose seems to  build auth context, not authenticate the user.","commit_id":"3c01f8762855e47f34823b76f5fd4a8780704718"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"7a011a534f3e1a966a9d3d9651e290d529046883","unresolved":false,"context_lines":[{"line_number":248,"context_line":"        auth_context[\u0027roles\u0027] \u003d [role[\u0027name\u0027] for role"},{"line_number":249,"context_line":"                                 in token_data[\u0027token\u0027][\u0027roles\u0027]]"},{"line_number":250,"context_line":"        return auth_context"},{"line_number":251,"context_line":""},{"line_number":252,"context_line":"    def _validate_trusted_issuer(self, env):"},{"line_number":253,"context_line":"        \"\"\"To further filter the certificates that are trusted."},{"line_number":254,"context_line":""}],"source_content_type":"text/x-python","patch_set":58,"id":"da20952f_e853f26a","line":251,"in_reply_to":"da20952f_7fe48cab","updated":"2015-09-02 08:38:42.000000000","message":"OK, apparently I am missing sometthing: When you use client SSL certificate - what are you going to get in return? An OpenStack token? A HTTP 200 with regard to the roles and project you are trying to access?\nCause I see lot\u0027s of code repeated and looks like token_helper does everything we already have - I am just wondering if we can avoid this.","commit_id":"3c01f8762855e47f34823b76f5fd4a8780704718"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"b73ef343145505abddc850b642106be5b2b6b7cb","unresolved":false,"context_lines":[{"line_number":248,"context_line":"        auth_context[\u0027roles\u0027] \u003d [role[\u0027name\u0027] for role"},{"line_number":249,"context_line":"                                 in token_data[\u0027token\u0027][\u0027roles\u0027]]"},{"line_number":250,"context_line":"        return auth_context"},{"line_number":251,"context_line":""},{"line_number":252,"context_line":"    def _validate_trusted_issuer(self, env):"},{"line_number":253,"context_line":"        \"\"\"To further filter the certificates that are trusted."},{"line_number":254,"context_line":""}],"source_content_type":"text/x-python","patch_set":58,"id":"da20952f_faae6a80","line":251,"in_reply_to":"da20952f_7fe48cab","updated":"2015-09-02 00:09:20.000000000","message":"yep, we are basically still building the auth context here.","commit_id":"3c01f8762855e47f34823b76f5fd4a8780704718"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"050cbc134e73e5936cdeccb4b2539246dff687cc","unresolved":false,"context_lines":[{"line_number":248,"context_line":"        auth_context[\u0027roles\u0027] \u003d [role[\u0027name\u0027] for role"},{"line_number":249,"context_line":"                                 in token_data[\u0027token\u0027][\u0027roles\u0027]]"},{"line_number":250,"context_line":"        return auth_context"},{"line_number":251,"context_line":""},{"line_number":252,"context_line":"    def _validate_trusted_issuer(self, env):"},{"line_number":253,"context_line":"        \"\"\"To further filter the certificates that are trusted."},{"line_number":254,"context_line":""}],"source_content_type":"text/x-python","patch_set":58,"id":"da20952f_7fe48cab","line":251,"in_reply_to":"da20952f_848cdeda","updated":"2015-09-01 23:56:19.000000000","message":"We are not authenticating the user. Like federation, user is authenticated if 2-Way SSL session is successfully establish. We are simple using the mapping to determine the certificate\u0027s authorization attributes.\n\nIf someone is calling \u0027curl -X POST /auth/tokens\u0027, they meant to get a token. In this case, if the accidentally use the cert in which we allow for tokenless authz, the auth context will still get built. But needless to say, it is redundent.\n\nTokenless authz is not meant for token request. It is intended to replaced the need for token request in order to perform the privilege operations.","commit_id":"3c01f8762855e47f34823b76f5fd4a8780704718"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"8ef21d617104cb2ff4cfacc399a723bd4ae9bb50","unresolved":false,"context_lines":[{"line_number":248,"context_line":"        auth_context[\u0027roles\u0027] \u003d [role[\u0027name\u0027] for role"},{"line_number":249,"context_line":"                                 in token_data[\u0027token\u0027][\u0027roles\u0027]]"},{"line_number":250,"context_line":"        return auth_context"},{"line_number":251,"context_line":""},{"line_number":252,"context_line":"    def _validate_trusted_issuer(self, env):"},{"line_number":253,"context_line":"        \"\"\"To further filter the certificates that are trusted."},{"line_number":254,"context_line":""}],"source_content_type":"text/x-python","patch_set":58,"id":"da20952f_ca204fb3","line":251,"in_reply_to":"da20952f_e853f26a","updated":"2015-09-02 16:15:41.000000000","message":"I am sure there\u0027s room for improvement, code wise. But do you see anything wrong with the logic itself?","commit_id":"3c01f8762855e47f34823b76f5fd4a8780704718"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"d075a9f2d6a8687e4041eac4d67a79a8c35fc0e7","unresolved":false,"context_lines":[{"line_number":280,"context_line":"        context[\u0027environment\u0027] \u003d env"},{"line_number":281,"context_line":"        initiator \u003d notifications._get_request_audit_info(context)"},{"line_number":282,"context_line":"        notifications.Audit.created(\u0027Client_Issuer_Not_Trusted\u0027,"},{"line_number":283,"context_line":"                                    client_issuer, initiator)"},{"line_number":284,"context_line":"        return False"},{"line_number":285,"context_line":""},{"line_number":286,"context_line":"    def process_request(self, request):"}],"source_content_type":"text/x-python","patch_set":58,"id":"da20952f_dee867b5","line":283,"updated":"2015-09-01 10:09:07.000000000","message":"so, this notification is emited here to notify that something went wrong, right? \nA comment would be useful, as Audit.created() looks like reserved for successful operations, while this one is not :-)\nAlso, I would like Steve to take a look at it. He is the gatekeeper here :-)","commit_id":"3c01f8762855e47f34823b76f5fd4a8780704718"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"b73ef343145505abddc850b642106be5b2b6b7cb","unresolved":false,"context_lines":[{"line_number":280,"context_line":"        context[\u0027environment\u0027] \u003d env"},{"line_number":281,"context_line":"        initiator \u003d notifications._get_request_audit_info(context)"},{"line_number":282,"context_line":"        notifications.Audit.created(\u0027Client_Issuer_Not_Trusted\u0027,"},{"line_number":283,"context_line":"                                    client_issuer, initiator)"},{"line_number":284,"context_line":"        return False"},{"line_number":285,"context_line":""},{"line_number":286,"context_line":"    def process_request(self, request):"}],"source_content_type":"text/x-python","patch_set":58,"id":"da20952f_9a9bae72","line":283,"in_reply_to":"da20952f_3a7382b6","updated":"2015-09-02 00:09:20.000000000","message":"yep, good point!","commit_id":"3c01f8762855e47f34823b76f5fd4a8780704718"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"d3a6b94a4d226575ace29f3f0420f426ddb9986b","unresolved":false,"context_lines":[{"line_number":280,"context_line":"        context[\u0027environment\u0027] \u003d env"},{"line_number":281,"context_line":"        initiator \u003d notifications._get_request_audit_info(context)"},{"line_number":282,"context_line":"        notifications.Audit.created(\u0027Client_Issuer_Not_Trusted\u0027,"},{"line_number":283,"context_line":"                                    client_issuer, initiator)"},{"line_number":284,"context_line":"        return False"},{"line_number":285,"context_line":""},{"line_number":286,"context_line":"    def process_request(self, request):"}],"source_content_type":"text/x-python","patch_set":58,"id":"da20952f_f040a609","line":283,"in_reply_to":"da20952f_9a9bae72","updated":"2015-09-02 16:40:12.000000000","message":"actually we don\u0027t need notification here. If client cert does not match trusted issues, it has no effect on the system","commit_id":"3c01f8762855e47f34823b76f5fd4a8780704718"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"050cbc134e73e5936cdeccb4b2539246dff687cc","unresolved":false,"context_lines":[{"line_number":280,"context_line":"        context[\u0027environment\u0027] \u003d env"},{"line_number":281,"context_line":"        initiator \u003d notifications._get_request_audit_info(context)"},{"line_number":282,"context_line":"        notifications.Audit.created(\u0027Client_Issuer_Not_Trusted\u0027,"},{"line_number":283,"context_line":"                                    client_issuer, initiator)"},{"line_number":284,"context_line":"        return False"},{"line_number":285,"context_line":""},{"line_number":286,"context_line":"    def process_request(self, request):"}],"source_content_type":"text/x-python","patch_set":58,"id":"da20952f_3a7382b6","line":283,"in_reply_to":"da20952f_dee867b5","updated":"2015-09-01 23:56:19.000000000","message":"Good point! We shouldn\u0027t be using \u0027created\u0027. Should be something similar to this\n\nhttps://github.com/openstack/keystone/blob/master/keystone/notifications.py#L545","commit_id":"3c01f8762855e47f34823b76f5fd4a8780704718"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"cb9f8a346d8c7d54f673ebd94a6fb5930be69415","unresolved":false,"context_lines":[{"line_number":232,"context_line":"            auth_context[\u0027roles\u0027] \u003d user_ref[\u0027roles\u0027]"},{"line_number":233,"context_line":"            return auth_context"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"        # it\u0027s the local user, so token data is needed."},{"line_number":236,"context_line":"        token_helper \u003d common.V3TokenDataHelper()"},{"line_number":237,"context_line":"        token_data \u003d token_helper.get_token_data("},{"line_number":238,"context_line":"            user_id\u003duser_ref[\u0027id\u0027],"}],"source_content_type":"text/x-python","patch_set":59,"id":"da20952f_3b311f0c","line":235,"updated":"2015-09-02 17:23:29.000000000","message":"(Nit) i prefer an explicit else for clarity","commit_id":"882a9d163726df4357783d7d3a729c814796a46c"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"02b358c124b022b82686996ae83e997a8d1ae288","unresolved":false,"context_lines":[{"line_number":232,"context_line":"            auth_context[\u0027roles\u0027] \u003d user_ref[\u0027roles\u0027]"},{"line_number":233,"context_line":"            return auth_context"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"        # it\u0027s the local user, so token data is needed."},{"line_number":236,"context_line":"        token_helper \u003d common.V3TokenDataHelper()"},{"line_number":237,"context_line":"        token_data \u003d token_helper.get_token_data("},{"line_number":238,"context_line":"            user_id\u003duser_ref[\u0027id\u0027],"}],"source_content_type":"text/x-python","patch_set":59,"id":"da20952f_961b62ca","line":235,"in_reply_to":"da20952f_3b311f0c","updated":"2015-09-02 17:39:57.000000000","message":"done.","commit_id":"882a9d163726df4357783d7d3a729c814796a46c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"cb9f8a346d8c7d54f673ebd94a6fb5930be69415","unresolved":false,"context_lines":[{"line_number":266,"context_line":"        if not client_issuer:"},{"line_number":267,"context_line":"            msg \u003d _LW(\u0027Cannot find client issuer in env by the \u0027"},{"line_number":268,"context_line":"                      \u0027issuer attribute - %s.\u0027)"},{"line_number":269,"context_line":"            LOG.warning(msg, CONF.tokenless_auth.issuer_attribute)"},{"line_number":270,"context_line":"            return False"},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"        if client_issuer in CONF.tokenless_auth.trusted_issuer:"}],"source_content_type":"text/x-python","patch_set":59,"id":"da20952f_36fff602","line":269,"updated":"2015-09-02 17:23:29.000000000","message":"Not sure if this should be a log warn or info. Maybe evaluate later","commit_id":"882a9d163726df4357783d7d3a729c814796a46c"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"02b358c124b022b82686996ae83e997a8d1ae288","unresolved":false,"context_lines":[{"line_number":266,"context_line":"        if not client_issuer:"},{"line_number":267,"context_line":"            msg \u003d _LW(\u0027Cannot find client issuer in env by the \u0027"},{"line_number":268,"context_line":"                      \u0027issuer attribute - %s.\u0027)"},{"line_number":269,"context_line":"            LOG.warning(msg, CONF.tokenless_auth.issuer_attribute)"},{"line_number":270,"context_line":"            return False"},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"        if client_issuer in CONF.tokenless_auth.trusted_issuer:"}],"source_content_type":"text/x-python","patch_set":59,"id":"da20952f_b6db06ed","line":269,"in_reply_to":"da20952f_36fff602","updated":"2015-09-02 17:39:57.000000000","message":"done.","commit_id":"882a9d163726df4357783d7d3a729c814796a46c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"cb9f8a346d8c7d54f673ebd94a6fb5930be69415","unresolved":false,"context_lines":[{"line_number":272,"context_line":"        if client_issuer in CONF.tokenless_auth.trusted_issuer:"},{"line_number":273,"context_line":"            return True"},{"line_number":274,"context_line":""},{"line_number":275,"context_line":"        msg \u003d _LW(\u0027The client issuer %(client_issuer)s does not match with \u0027"},{"line_number":276,"context_line":"                  \u0027the trusted issuer %(trusted_issuer)s\u0027)"},{"line_number":277,"context_line":"        LOG.warning("},{"line_number":278,"context_line":"            msg, {\u0027client_issuer\u0027: client_issuer,"}],"source_content_type":"text/x-python","patch_set":59,"id":"da20952f_d63c7ac1","line":275,"updated":"2015-09-02 17:23:29.000000000","message":"This is not log warn. Please fix in a followup patch to at most log info. Do not spam logs at warning level for a legitimate case of \"user passed a cert that isnt from a trusted issuer\" - this is a valid case that should be at most informational. The deployer has nothing to do here in most cases.","commit_id":"882a9d163726df4357783d7d3a729c814796a46c"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"02b358c124b022b82686996ae83e997a8d1ae288","unresolved":false,"context_lines":[{"line_number":272,"context_line":"        if client_issuer in CONF.tokenless_auth.trusted_issuer:"},{"line_number":273,"context_line":"            return True"},{"line_number":274,"context_line":""},{"line_number":275,"context_line":"        msg \u003d _LW(\u0027The client issuer %(client_issuer)s does not match with \u0027"},{"line_number":276,"context_line":"                  \u0027the trusted issuer %(trusted_issuer)s\u0027)"},{"line_number":277,"context_line":"        LOG.warning("},{"line_number":278,"context_line":"            msg, {\u0027client_issuer\u0027: client_issuer,"}],"source_content_type":"text/x-python","patch_set":59,"id":"da20952f_96e04298","line":275,"in_reply_to":"da20952f_d63c7ac1","updated":"2015-09-02 17:39:57.000000000","message":"agreed.","commit_id":"882a9d163726df4357783d7d3a729c814796a46c"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"375698f405d8e01363afb3ded360a4d6210a26ae","unresolved":false,"context_lines":[{"line_number":248,"context_line":"                auth_context[\u0027project_id\u0027] \u003d project_id"},{"line_number":249,"context_line":"            auth_context[\u0027roles\u0027] \u003d [role[\u0027name\u0027] for role"},{"line_number":250,"context_line":"                                     in token_data[\u0027token\u0027][\u0027roles\u0027]]"},{"line_number":251,"context_line":"            return auth_context"},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"    def _validate_trusted_issuer(self, env):"},{"line_number":254,"context_line":"        \"\"\"To further filter the certificates that are trusted."}],"source_content_type":"text/x-python","patch_set":60,"id":"da20952f_60ca7f1c","line":251,"updated":"2015-09-02 18:52:40.000000000","message":"\"return auth_context\" can be moved out of the if/else condition","commit_id":"70a2e91f798dc423705d6a10f3be1996a7cc31de"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"375698f405d8e01363afb3ded360a4d6210a26ae","unresolved":false,"context_lines":[{"line_number":272,"context_line":"        if client_issuer in CONF.tokenless_auth.trusted_issuer:"},{"line_number":273,"context_line":"            return True"},{"line_number":274,"context_line":""},{"line_number":275,"context_line":"        msg \u003d _LW(\u0027The client issuer %(client_issuer)s does not match with \u0027"},{"line_number":276,"context_line":"                  \u0027the trusted issuer %(trusted_issuer)s\u0027)"},{"line_number":277,"context_line":"        LOG.info("},{"line_number":278,"context_line":"            msg, {\u0027client_issuer\u0027: client_issuer,"}],"source_content_type":"text/x-python","patch_set":60,"id":"da20952f_c0b02b8e","line":275,"updated":"2015-09-02 18:52:40.000000000","message":"should be _LI instead of _LW","commit_id":"70a2e91f798dc423705d6a10f3be1996a7cc31de"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"375698f405d8e01363afb3ded360a4d6210a26ae","unresolved":false,"context_lines":[{"line_number":300,"context_line":"                request.environ)"},{"line_number":301,"context_line":"        else:"},{"line_number":302,"context_line":"            LOG.debug(\u0027There is either no auth token in the request or \u0027"},{"line_number":303,"context_line":"                      \u0027the certificate issuer in the Tokenless auth is \u0027"},{"line_number":304,"context_line":"                      \u0027not trusted. No auth context will be set.\u0027)"},{"line_number":305,"context_line":"            return"},{"line_number":306,"context_line":"        LOG.debug(\u0027RBAC: auth_context: %s\u0027, auth_context)"}],"source_content_type":"text/x-python","patch_set":60,"id":"da20952f_2047a778","line":303,"updated":"2015-09-02 18:52:40.000000000","message":"not sure if we want to include the tokenless auth in the message,  as x509 is an additional setup and won\u0027t always be configured in keystone.","commit_id":"70a2e91f798dc423705d6a10f3be1996a7cc31de"}],"keystone/tests/unit/mapping_fixtures.py":[{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"99a8e51e8bba3291f7b20118fe500016df0ab8ac","unresolved":false,"context_lines":[{"line_number":1069,"context_line":"                        \u0027user_name\u0027: \u0027{0}\u0027"},{"line_number":1070,"context_line":"                    },"},{"line_number":1071,"context_line":"                    \u0027group\u0027: {"},{"line_number":1072,"context_line":"                        \u0027id\u0027: \u0027dummy\u0027"},{"line_number":1073,"context_line":"                    }"},{"line_number":1074,"context_line":"                }"},{"line_number":1075,"context_line":"            ],"}],"source_content_type":"text/x-python","patch_set":47,"id":"3a50d1a3_d280264c","line":1072,"updated":"2015-07-30 19:16:53.000000000","message":"you may want to re-use the group_id at the top of the file?  or just use a random one?","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"288bb4dade83c0212c1f9f86638d0843b09cae40","unresolved":false,"context_lines":[{"line_number":1069,"context_line":"                        \u0027user_name\u0027: \u0027{0}\u0027"},{"line_number":1070,"context_line":"                    },"},{"line_number":1071,"context_line":"                    \u0027group\u0027: {"},{"line_number":1072,"context_line":"                        \u0027id\u0027: \u0027dummy\u0027"},{"line_number":1073,"context_line":"                    }"},{"line_number":1074,"context_line":"                }"},{"line_number":1075,"context_line":"            ],"}],"source_content_type":"text/x-python","patch_set":47,"id":"3a50d1a3_d3b8efc9","line":1072,"in_reply_to":"3a50d1a3_d280264c","updated":"2015-07-31 21:31:31.000000000","message":"I wanted the group id can be passed from the test case. like \ntest_middleware.py:609 and 672.","commit_id":"3d0006fde1d3fd72545d21f0f5f5d1a0e4e453ae"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"b855d7436c76de567dae2d6451b38b78d528dffd","unresolved":false,"context_lines":[{"line_number":910,"context_line":"                    \u0027user\u0027: {"},{"line_number":911,"context_line":"                        \u0027user_name\u0027: \u0027{0}\u0027,"},{"line_number":912,"context_line":"                        \u0027domain_name\u0027: \u0027{1}\u0027,"},{"line_number":913,"context_line":"                        \u0027type\u0027: \u0027local\u0027"},{"line_number":914,"context_line":"                    }"},{"line_number":915,"context_line":"                }"},{"line_number":916,"context_line":"            ],"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_376e2630","line":913,"updated":"2015-08-27 12:57:53.000000000","message":"While the mapping engine is quite liberate we normally don\u0027t support domain_name, user_name. It\u0027s rather:\n\ndomain: {\n    \u0027id\u0027: id\n}\n\ndomain: {\n    \u0027name;: name\n}\n\nso unless you have a good argument I\u0027d stick with that notation.","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"d9e08f1ceb45ea04555b48d7b3fb86fd0991fe85","unresolved":false,"context_lines":[{"line_number":910,"context_line":"                    \u0027user\u0027: {"},{"line_number":911,"context_line":"                        \u0027user_name\u0027: \u0027{0}\u0027,"},{"line_number":912,"context_line":"                        \u0027domain_name\u0027: \u0027{1}\u0027,"},{"line_number":913,"context_line":"                        \u0027type\u0027: \u0027local\u0027"},{"line_number":914,"context_line":"                    }"},{"line_number":915,"context_line":"                }"},{"line_number":916,"context_line":"            ],"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_ef88b724","line":913,"in_reply_to":"da20952f_376e2630","updated":"2015-08-27 22:42:00.000000000","message":"fine with me","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"b855d7436c76de567dae2d6451b38b78d528dffd","unresolved":false,"context_lines":[{"line_number":936,"context_line":"                    \u0027user\u0027: {"},{"line_number":937,"context_line":"                        \u0027user_id\u0027: \u0027{0}\u0027,"},{"line_number":938,"context_line":"                        \u0027domain_name\u0027: \u0027{1}\u0027,"},{"line_number":939,"context_line":"                        \u0027type\u0027: \u0027local\u0027"},{"line_number":940,"context_line":"                    }"},{"line_number":941,"context_line":"                }"},{"line_number":942,"context_line":"            ],"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_975ff271","line":939,"updated":"2015-08-27 12:57:53.000000000","message":"if the user type is local and his user_id is specified you normally don\u0027t need domain.","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"d9e08f1ceb45ea04555b48d7b3fb86fd0991fe85","unresolved":false,"context_lines":[{"line_number":936,"context_line":"                    \u0027user\u0027: {"},{"line_number":937,"context_line":"                        \u0027user_id\u0027: \u0027{0}\u0027,"},{"line_number":938,"context_line":"                        \u0027domain_name\u0027: \u0027{1}\u0027,"},{"line_number":939,"context_line":"                        \u0027type\u0027: \u0027local\u0027"},{"line_number":940,"context_line":"                    }"},{"line_number":941,"context_line":"                }"},{"line_number":942,"context_line":"            ],"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_4f320412","line":939,"in_reply_to":"da20952f_975ff271","updated":"2015-08-27 22:42:00.000000000","message":"yeah, that\u0027s right. we don\u0027t necessarily need it here but it can be just a test case though ;-) \nI have another test case with the user id only.","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"}],"keystone/tests/unit/test_middleware.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"b5e1abb181363a4ae665762902c5f5f6601e2e2e","unresolved":false,"context_lines":[{"line_number":13,"context_line":"# under the License."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"from oslo_config import cfg"},{"line_number":16,"context_line":"import uuid"},{"line_number":17,"context_line":"import webob"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"from keystone.auth import controllers"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a80dd14_77e4650d","line":16,"updated":"2015-03-05 07:56:34.000000000","message":"this should go into it\u0027s own grouping above oslo_config import, since uuid is a standard library","commit_id":"7ac24a995cc44037e6c8e7003ee3b6d054eee0a5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"b5e1abb181363a4ae665762902c5f5f6601e2e2e","unresolved":false,"context_lines":[{"line_number":136,"context_line":"                              \u0027OU\u003dprojectA,O\u003ddomainA.com,L\u003dSunnyvale,\u0027 \\"},{"line_number":137,"context_line":"                              \u0027ST\u003dCalifornia,C\u003dUS\u0027"},{"line_number":138,"context_line":"        CONF.tokenless_auth.trusted_issuer \u003d self.trusted_issuer"},{"line_number":139,"context_line":"        CONF.tokenless_auth.methods \u003d [\u0027external\u0027, \u0027password\u0027, \u0027token\u0027]"},{"line_number":140,"context_line":"        controllers.load_auth_methods()"},{"line_number":141,"context_line":"        self.load_sample_data()"},{"line_number":142,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"9a80dd14_d7a191aa","line":139,"updated":"2015-03-05 07:56:34.000000000","message":"the \u0027methods\u0027 option doesn\u0027t exist for CONF.tokenless_auth, only trusted_issuer, protocol and issuer\n\nalso, if you meant to change CONF.auth.methods, it\u0027s not necessary since those 3 auth methods are the default","commit_id":"7ac24a995cc44037e6c8e7003ee3b6d054eee0a5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"8e57299d684e4f67827324c27382a69653b2bf3a","unresolved":false,"context_lines":[{"line_number":136,"context_line":"                              \u0027OU\u003dprojectA,O\u003ddomainA.com,L\u003dSunnyvale,\u0027 \\"},{"line_number":137,"context_line":"                              \u0027ST\u003dCalifornia,C\u003dUS\u0027"},{"line_number":138,"context_line":"        CONF.tokenless_auth.trusted_issuer \u003d self.trusted_issuer"},{"line_number":139,"context_line":"        CONF.tokenless_auth.methods \u003d [\u0027external\u0027, \u0027password\u0027, \u0027token\u0027]"},{"line_number":140,"context_line":"        controllers.load_auth_methods()"},{"line_number":141,"context_line":"        self.load_sample_data()"},{"line_number":142,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"9a80dd14_6069ca24","line":139,"in_reply_to":"9a80dd14_d7a191aa","updated":"2015-03-06 02:00:01.000000000","message":"good catch!","commit_id":"7ac24a995cc44037e6c8e7003ee3b6d054eee0a5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"b5e1abb181363a4ae665762902c5f5f6601e2e2e","unresolved":false,"context_lines":[{"line_number":137,"context_line":"                              \u0027ST\u003dCalifornia,C\u003dUS\u0027"},{"line_number":138,"context_line":"        CONF.tokenless_auth.trusted_issuer \u003d self.trusted_issuer"},{"line_number":139,"context_line":"        CONF.tokenless_auth.methods \u003d [\u0027external\u0027, \u0027password\u0027, \u0027token\u0027]"},{"line_number":140,"context_line":"        controllers.load_auth_methods()"},{"line_number":141,"context_line":"        self.load_sample_data()"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"    def load_sample_data(self):"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a80dd14_77ff0535","line":140,"updated":"2015-03-05 07:56:34.000000000","message":"is this necessary?","commit_id":"7ac24a995cc44037e6c8e7003ee3b6d054eee0a5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"8e57299d684e4f67827324c27382a69653b2bf3a","unresolved":false,"context_lines":[{"line_number":137,"context_line":"                              \u0027ST\u003dCalifornia,C\u003dUS\u0027"},{"line_number":138,"context_line":"        CONF.tokenless_auth.trusted_issuer \u003d self.trusted_issuer"},{"line_number":139,"context_line":"        CONF.tokenless_auth.methods \u003d [\u0027external\u0027, \u0027password\u0027, \u0027token\u0027]"},{"line_number":140,"context_line":"        controllers.load_auth_methods()"},{"line_number":141,"context_line":"        self.load_sample_data()"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"    def load_sample_data(self):"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a80dd14_a0e1029c","line":140,"in_reply_to":"9a80dd14_77ff0535","updated":"2015-03-06 02:00:01.000000000","message":"not sure why I needed it the first place. but yeah, another good catch, I don\u0027t actually need it.","commit_id":"7ac24a995cc44037e6c8e7003ee3b6d054eee0a5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"b5e1abb181363a4ae665762902c5f5f6601e2e2e","unresolved":false,"context_lines":[{"line_number":142,"context_line":""},{"line_number":143,"context_line":"    def load_sample_data(self):"},{"line_number":144,"context_line":"        self.domain_id \u003d uuid.uuid4().hex"},{"line_number":145,"context_line":"        self.domain_name \u003d \u0027domainA.com\u0027"},{"line_number":146,"context_line":"        self.project_id \u003d uuid.uuid4().hex"},{"line_number":147,"context_line":"        self.project_name \u003d \u0027projectA\u0027"},{"line_number":148,"context_line":"        self.user_name \u003d \u0027userA\u0027"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a80dd14_9749d9d2","line":145,"updated":"2015-03-05 07:56:34.000000000","message":"these, and most others can all be uuids","commit_id":"7ac24a995cc44037e6c8e7003ee3b6d054eee0a5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"8e57299d684e4f67827324c27382a69653b2bf3a","unresolved":false,"context_lines":[{"line_number":142,"context_line":""},{"line_number":143,"context_line":"    def load_sample_data(self):"},{"line_number":144,"context_line":"        self.domain_id \u003d uuid.uuid4().hex"},{"line_number":145,"context_line":"        self.domain_name \u003d \u0027domainA.com\u0027"},{"line_number":146,"context_line":"        self.project_id \u003d uuid.uuid4().hex"},{"line_number":147,"context_line":"        self.project_name \u003d \u0027projectA\u0027"},{"line_number":148,"context_line":"        self.user_name \u003d \u0027userA\u0027"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a80dd14_43f9307f","line":145,"in_reply_to":"9a80dd14_9749d9d2","updated":"2015-03-06 02:00:01.000000000","message":"yes, I should be able to use uuids for the others.","commit_id":"7ac24a995cc44037e6c8e7003ee3b6d054eee0a5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"b5e1abb181363a4ae665762902c5f5f6601e2e2e","unresolved":false,"context_lines":[{"line_number":150,"context_line":"        self.user_email \u003d \u0027userA@domainA.com\u0027"},{"line_number":151,"context_line":"        # This idp_is is calculated based on"},{"line_number":152,"context_line":"        # base64(sha256(self.client_issuer))"},{"line_number":153,"context_line":"        self.idp_id \u003d \u0027ft/ZbwtftULvL+gb2yO1d9X23WZ4kZ0yRvOufM6RCmo\u003d\u0027"},{"line_number":154,"context_line":"        self.protocol_id \u003d CONF.tokenless_auth.protocol"},{"line_number":155,"context_line":"        self.role_id \u003d uuid.uuid4().hex"},{"line_number":156,"context_line":"        self.role_name \u003d \u0027roleA\u0027"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a80dd14_373bcd3b","line":153,"updated":"2015-03-05 07:56:34.000000000","message":"i\u0027d prefer that the value for this variable actually use some function instead of hardcoding it.\n\n  self.idp_id \u003d base64(sha256(self.client_issuer))\n\nthis way, in case someone changes the client issuer, we are not broken.","commit_id":"7ac24a995cc44037e6c8e7003ee3b6d054eee0a5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"ff0c835f3f0362d1e610e584a93064d49c7a05b9","unresolved":false,"context_lines":[{"line_number":150,"context_line":"        self.user_email \u003d \u0027userA@domainA.com\u0027"},{"line_number":151,"context_line":"        # This idp_is is calculated based on"},{"line_number":152,"context_line":"        # base64(sha256(self.client_issuer))"},{"line_number":153,"context_line":"        self.idp_id \u003d \u0027ft/ZbwtftULvL+gb2yO1d9X23WZ4kZ0yRvOufM6RCmo\u003d\u0027"},{"line_number":154,"context_line":"        self.protocol_id \u003d CONF.tokenless_auth.protocol"},{"line_number":155,"context_line":"        self.role_id \u003d uuid.uuid4().hex"},{"line_number":156,"context_line":"        self.role_name \u003d \u0027roleA\u0027"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a80dd14_f2e223d4","line":153,"in_reply_to":"9a80dd14_373bcd3b","updated":"2015-03-05 08:12:29.000000000","message":"Agree","commit_id":"7ac24a995cc44037e6c8e7003ee3b6d054eee0a5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4b0fd996afa2e2eee6187f6d546a8e4ade94ac4f","unresolved":false,"context_lines":[{"line_number":125,"context_line":"        self.assertEqual({}, params)"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"class AuthContextMiddlewareTest(test_backend_sql.SqlTests, tests.TestCase):"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"    def setUp(self):"},{"line_number":131,"context_line":"        super(AuthContextMiddlewareTest, self).setUp()"}],"source_content_type":"text/x-python","patch_set":14,"id":"9a80dd14_4673fe7f","line":128,"updated":"2015-03-06 02:40:33.000000000","message":"whats the benefit of the sqlTests mixin?","commit_id":"5005addff91905c4e5d8a40bb802023aedfe4153"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"bd27e9a10e8561af76fc045b8a56a4b21eaa1160","unresolved":false,"context_lines":[{"line_number":125,"context_line":"        self.assertEqual({}, params)"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"class AuthContextMiddlewareTest(test_backend_sql.SqlTests, tests.TestCase):"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"    def setUp(self):"},{"line_number":131,"context_line":"        super(AuthContextMiddlewareTest, self).setUp()"}],"source_content_type":"text/x-python","patch_set":14,"id":"9a80dd14_687268ae","line":128,"in_reply_to":"9a80dd14_4673fe7f","updated":"2015-03-06 23:41:31.000000000","message":"SqlTests sets up the backend sql drivers, like the reference to self.resource_api.create_domain and self.resource_api.create_project\nBut I actually don\u0027t have to extend from tests.TestCase, SqlTests has already extend from it.","commit_id":"5005addff91905c4e5d8a40bb802023aedfe4153"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c2b752db2ecd3e371e779476dbf2ab5e3a2289f9","unresolved":false,"context_lines":[{"line_number":271,"context_line":"            ]"},{"line_number":272,"context_line":"        }"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"        self.rules_with_userid_and_domain_id \u003d {"},{"line_number":275,"context_line":"            \u0027rules\u0027: ["},{"line_number":276,"context_line":"                {"},{"line_number":277,"context_line":"                    \u0027local\u0027: ["}],"source_content_type":"text/x-python","patch_set":14,"id":"9a80dd14_a61cbac2","line":274,"updated":"2015-03-06 02:42:20.000000000","message":"also, fwiw, you can add these to https://github.com/openstack/keystone/blob/3236e5e7c6175898ec6e0fec9e9ff9d5b0775ae5/keystone/tests/unit/mapping_fixtures.py if you so desire","commit_id":"5005addff91905c4e5d8a40bb802023aedfe4153"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"bd27e9a10e8561af76fc045b8a56a4b21eaa1160","unresolved":false,"context_lines":[{"line_number":271,"context_line":"            ]"},{"line_number":272,"context_line":"        }"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"        self.rules_with_userid_and_domain_id \u003d {"},{"line_number":275,"context_line":"            \u0027rules\u0027: ["},{"line_number":276,"context_line":"                {"},{"line_number":277,"context_line":"                    \u0027local\u0027: ["}],"source_content_type":"text/x-python","patch_set":14,"id":"9a80dd14_a8dc6074","line":274,"in_reply_to":"9a80dd14_a61cbac2","updated":"2015-03-06 23:41:31.000000000","message":"that\u0027s a good idea","commit_id":"5005addff91905c4e5d8a40bb802023aedfe4153"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4b0fd996afa2e2eee6187f6d546a8e4ade94ac4f","unresolved":false,"context_lines":[{"line_number":391,"context_line":""},{"line_number":392,"context_line":"    def test_client_issuer_not_trusted(self):"},{"line_number":393,"context_line":"        req \u003d make_request()"},{"line_number":394,"context_line":"        req.environ[CONF.tokenless_auth.issuer_attribute] \u003d \\"},{"line_number":395,"context_line":"            self.untrusted_client_issuer"},{"line_number":396,"context_line":"        req.environ[\u0027HTTP_X_PROJECT_ID\u0027] \u003d uuid.uuid4().hex"},{"line_number":397,"context_line":"        middleware.AuthContextMiddleware(None).process_request(req)"}],"source_content_type":"text/x-python","patch_set":14,"id":"9a80dd14_46cf7e7f","line":394,"updated":"2015-03-06 02:40:33.000000000","message":"use () instead of \\","commit_id":"5005addff91905c4e5d8a40bb802023aedfe4153"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4b0fd996afa2e2eee6187f6d546a8e4ade94ac4f","unresolved":false,"context_lines":[{"line_number":409,"context_line":"        middleware.AuthContextMiddleware(None).process_request(req)"},{"line_number":410,"context_line":"        context \u003d req.environ.get(authorization.AUTH_CONTEXT_ENV)"},{"line_number":411,"context_line":"        self.assertIsNotNone(context)"},{"line_number":412,"context_line":"        self.assertEqual(context[\u0027project_id\u0027], self.project[\u0027id\u0027])"},{"line_number":413,"context_line":"        self.assertEqual(context[\u0027user_id\u0027], self.user[\u0027id\u0027])"},{"line_number":414,"context_line":"        self.assertEqual(context[\u0027roles\u0027][0], self.role_name)"},{"line_number":415,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"9a80dd14_06b2e6e5","line":412,"updated":"2015-03-06 02:40:33.000000000","message":"these 4 lines are repeated a bunch, why not create a private function called\n\n  _assert_tokenless_auth_context(context):","commit_id":"5005addff91905c4e5d8a40bb802023aedfe4153"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4b0fd996afa2e2eee6187f6d546a8e4ade94ac4f","unresolved":false,"context_lines":[{"line_number":453,"context_line":"        middleware.AuthContextMiddleware(None).process_request(req)"},{"line_number":454,"context_line":"        context \u003d req.environ.get(authorization.AUTH_CONTEXT_ENV)"},{"line_number":455,"context_line":"        self.assertIsNotNone(context)"},{"line_number":456,"context_line":"        self.assertEqual(context[\u0027project_id\u0027], self.project[\u0027id\u0027])"},{"line_number":457,"context_line":"        self.assertEqual(context[\u0027user_id\u0027], self.user[\u0027id\u0027])"},{"line_number":458,"context_line":"        self.assertEqual(context[\u0027roles\u0027][0], self.role_name)"},{"line_number":459,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"9a80dd14_269e0a57","line":456,"updated":"2015-03-06 02:40:33.000000000","message":"this should be:\n\n  self.assertEqual(self.project[\u0027id\u0027], context[\u0027project_id\u0027])\n\nso it\u0027s:\n\n  assertEqual(expected, observed)","commit_id":"5005addff91905c4e5d8a40bb802023aedfe4153"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4b0fd996afa2e2eee6187f6d546a8e4ade94ac4f","unresolved":false,"context_lines":[{"line_number":465,"context_line":"        req.environ[\u0027SSL_CLIENT_I_DN_O\u0027] \u003d self.domain_name"},{"line_number":466,"context_line":"        self.load_mapping_rules(self.rules_with_username_and_domain_name)"},{"line_number":467,"context_line":"        context \u003d middleware.AuthContextMiddleware(None)"},{"line_number":468,"context_line":"        self.assertRaises(exception.ValidationError,"},{"line_number":469,"context_line":"                          context.process_request,"},{"line_number":470,"context_line":"                          req)"},{"line_number":471,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"9a80dd14_46f93e7f","line":468,"updated":"2015-03-06 02:40:33.000000000","message":"in the tokenless_auth.py file, 6 new exceptions are being raises, but you\u0027re only testing for one, which makes me think that the coverage is lacking, can you look into adding more malicious tests?","commit_id":"5005addff91905c4e5d8a40bb802023aedfe4153"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"bd27e9a10e8561af76fc045b8a56a4b21eaa1160","unresolved":false,"context_lines":[{"line_number":465,"context_line":"        req.environ[\u0027SSL_CLIENT_I_DN_O\u0027] \u003d self.domain_name"},{"line_number":466,"context_line":"        self.load_mapping_rules(self.rules_with_username_and_domain_name)"},{"line_number":467,"context_line":"        context \u003d middleware.AuthContextMiddleware(None)"},{"line_number":468,"context_line":"        self.assertRaises(exception.ValidationError,"},{"line_number":469,"context_line":"                          context.process_request,"},{"line_number":470,"context_line":"                          req)"},{"line_number":471,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"9a80dd14_87f14203","line":468,"in_reply_to":"9a80dd14_46f93e7f","updated":"2015-03-06 23:41:31.000000000","message":"that\u0027s right, I missed some of the test cases.","commit_id":"5005addff91905c4e5d8a40bb802023aedfe4153"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4b0fd996afa2e2eee6187f6d546a8e4ade94ac4f","unresolved":false,"context_lines":[{"line_number":482,"context_line":"        self.assertIsNotNone(context)"},{"line_number":483,"context_line":"        self.assertEqual(context[\u0027project_id\u0027], self.project[\u0027id\u0027])"},{"line_number":484,"context_line":"        self.assertEqual(context[\u0027user_id\u0027], self.user[\u0027id\u0027])"},{"line_number":485,"context_line":"        self.assertEqual(context[\u0027roles\u0027][0], self.role_name)"},{"line_number":486,"context_line":""},{"line_number":487,"context_line":"    def test_mapping_with_userid_and_domainname_success(self):"},{"line_number":488,"context_line":"        req \u003d make_request()"}],"source_content_type":"text/x-python","patch_set":14,"id":"9a80dd14_86a096a0","line":485,"updated":"2015-03-06 02:40:33.000000000","message":"use assertIn, more info below","commit_id":"5005addff91905c4e5d8a40bb802023aedfe4153"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4b0fd996afa2e2eee6187f6d546a8e4ade94ac4f","unresolved":false,"context_lines":[{"line_number":495,"context_line":"        middleware.AuthContextMiddleware(None).process_request(req)"},{"line_number":496,"context_line":"        context \u003d req.environ.get(authorization.AUTH_CONTEXT_ENV)"},{"line_number":497,"context_line":"        self.assertIsNotNone(context)"},{"line_number":498,"context_line":"        self.assertEqual(context[\u0027project_id\u0027], self.project[\u0027id\u0027])"},{"line_number":499,"context_line":"        self.assertEqual(context[\u0027user_id\u0027], self.user[\u0027id\u0027])"},{"line_number":500,"context_line":"        self.assertEqual(context[\u0027roles\u0027][0], self.role_name)"},{"line_number":501,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"9a80dd14_6691e251","line":498,"updated":"2015-03-06 02:40:33.000000000","message":"theres a bunch of instances of self.project[\u0027id\u0027], but you could just use self.project_id, not a big deal, but it\u0027ll be nice to be consistent.\n\nsame goes for domain_id","commit_id":"5005addff91905c4e5d8a40bb802023aedfe4153"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4b0fd996afa2e2eee6187f6d546a8e4ade94ac4f","unresolved":false,"context_lines":[{"line_number":512,"context_line":"        self.assertIsNotNone(context)"},{"line_number":513,"context_line":"        self.assertEqual(context[\u0027project_id\u0027], self.project[\u0027id\u0027])"},{"line_number":514,"context_line":"        self.assertEqual(context[\u0027user_id\u0027], self.user[\u0027id\u0027])"},{"line_number":515,"context_line":"        self.assertEqual(context[\u0027roles\u0027][0], self.role_name)"}],"source_content_type":"text/x-python","patch_set":14,"id":"9a80dd14_e6d79221","line":515,"updated":"2015-03-06 02:40:33.000000000","message":"you can use \n\n  self.assertIn(self.role_name, context[\u0027roles\u0027])","commit_id":"5005addff91905c4e5d8a40bb802023aedfe4153"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":133,"context_line":"        self.client_issuer \u003d uuid.uuid4().hex"},{"line_number":134,"context_line":"        self.untrusted_client_issuer \u003d uuid.uuid4().hex"},{"line_number":135,"context_line":"        self.trusted_issuer \u003d self.client_issuer"},{"line_number":136,"context_line":"        CONF.tokenless_auth.trusted_issuer \u003d [self.trusted_issuer]"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"        # This idp_is is calculated based on"},{"line_number":139,"context_line":"        # base64(sha256(self.client_issuer))"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_68bda067","line":136,"updated":"2015-05-01 15:51:04.000000000","message":"use the config fixture.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":135,"context_line":"        self.trusted_issuer \u003d self.client_issuer"},{"line_number":136,"context_line":"        CONF.tokenless_auth.trusted_issuer \u003d [self.trusted_issuer]"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"        # This idp_is is calculated based on"},{"line_number":139,"context_line":"        # base64(sha256(self.client_issuer))"},{"line_number":140,"context_line":"        hashed_idp \u003d hashlib.sha256(self.client_issuer)"},{"line_number":141,"context_line":"        self.idp_id \u003d base64.b64encode(hashed_idp.digest())"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_e8b1b090","line":138,"updated":"2015-05-01 15:51:04.000000000","message":"change \"idp_is\" to \"idp_id\"","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":246,"context_line":"        req \u003d make_request()"},{"line_number":247,"context_line":"        token_id \u003d uuid.uuid4().hex"},{"line_number":248,"context_line":"        req.environ[authorization.AUTH_CONTEXT_ENV] \u003d {\u0027token_id\u0027: token_id}"},{"line_number":249,"context_line":"        middleware.AuthContextMiddleware(None).process_request(req)"},{"line_number":250,"context_line":"        context \u003d req.environ[authorization.AUTH_CONTEXT_ENV]"},{"line_number":251,"context_line":"        self.assertEqual(token_id, context[\u0027token_id\u0027])"},{"line_number":252,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_c85a7450","line":249,"updated":"2015-05-01 15:51:04.000000000","message":"what\u0027s the None magic value for? give it a name.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":246,"context_line":"        req \u003d make_request()"},{"line_number":247,"context_line":"        token_id \u003d uuid.uuid4().hex"},{"line_number":248,"context_line":"        req.environ[authorization.AUTH_CONTEXT_ENV] \u003d {\u0027token_id\u0027: token_id}"},{"line_number":249,"context_line":"        middleware.AuthContextMiddleware(None).process_request(req)"},{"line_number":250,"context_line":"        context \u003d req.environ[authorization.AUTH_CONTEXT_ENV]"},{"line_number":251,"context_line":"        self.assertEqual(token_id, context[\u0027token_id\u0027])"},{"line_number":252,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_d5120109","line":249,"in_reply_to":"3acd31a7_c85a7450","updated":"2015-05-01 21:28:34.000000000","message":"yep!","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":253,"context_line":"    def test_not_applicable_to_token_request(self):"},{"line_number":254,"context_line":"        req \u003d make_request()"},{"line_number":255,"context_line":"        req.environ[\u0027PATH_INFO\u0027] \u003d \u0027/auth/tokens\u0027"},{"line_number":256,"context_line":"        req.environ[\u0027REQUEST_METHOD\u0027] \u003d \u0027POST\u0027"},{"line_number":257,"context_line":"        middleware.AuthContextMiddleware(None).process_request(req)"},{"line_number":258,"context_line":"        context \u003d req.environ.get(authorization.AUTH_CONTEXT_ENV)"},{"line_number":259,"context_line":"        self.assertIsNone(context)"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_e82650cd","line":256,"updated":"2015-05-01 15:51:04.000000000","message":"should be able to pass a dict into make_request to set the environ.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":261,"context_line":"    def test_no_tokenless_attributes_request(self):"},{"line_number":262,"context_line":"        req \u003d make_request()"},{"line_number":263,"context_line":"        middleware.AuthContextMiddleware(None).process_request(req)"},{"line_number":264,"context_line":"        context \u003d req.environ.get(authorization.AUTH_CONTEXT_ENV)"},{"line_number":265,"context_line":"        self.assertIsNone(context)"},{"line_number":266,"context_line":""},{"line_number":267,"context_line":"    def test_no_issuer_attribute_request(self):"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_c8083430","line":264,"updated":"2015-05-01 15:51:04.000000000","message":"these lines are copy-pasted a lot, suggest create a function to reduce duplication.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":261,"context_line":"    def test_no_tokenless_attributes_request(self):"},{"line_number":262,"context_line":"        req \u003d make_request()"},{"line_number":263,"context_line":"        middleware.AuthContextMiddleware(None).process_request(req)"},{"line_number":264,"context_line":"        context \u003d req.environ.get(authorization.AUTH_CONTEXT_ENV)"},{"line_number":265,"context_line":"        self.assertIsNone(context)"},{"line_number":266,"context_line":""},{"line_number":267,"context_line":"    def test_no_issuer_attribute_request(self):"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_f5261d67","line":264,"in_reply_to":"3acd31a7_c8083430","updated":"2015-05-01 21:28:34.000000000","message":"yes, agree.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":310,"context_line":"        req \u003d make_request()"},{"line_number":311,"context_line":"        req.environ[CONF.tokenless_auth.issuer_attribute] \u003d self.client_issuer"},{"line_number":312,"context_line":"        req.environ[\u0027HTTP_X_PROJECT_ID\u0027] \u003d uuid.uuid4().hex"},{"line_number":313,"context_line":"        CONF.tokenless_auth.trusted_issuer \u003d []"},{"line_number":314,"context_line":"        middleware.AuthContextMiddleware(None).process_request(req)"},{"line_number":315,"context_line":"        context \u003d req.environ.get(authorization.AUTH_CONTEXT_ENV)"},{"line_number":316,"context_line":"        self.assertIsNone(context)"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_0e007500","line":313,"updated":"2015-05-01 15:51:04.000000000","message":"use the config fixture.","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a097e91a561e5314e9645f8421940cd1c05cd46a","unresolved":false,"context_lines":[{"line_number":379,"context_line":"        req \u003d make_request()"},{"line_number":380,"context_line":"        req.environ[CONF.tokenless_auth.issuer_attribute] \u003d self.client_issuer"},{"line_number":381,"context_line":"        req.environ[\u0027HTTP_X_PROJECT_NAME\u0027] \u003d self.project_id"},{"line_number":382,"context_line":"        req.environ[\u0027SSL_CLIENT_S_DN_CN\u0027] \u003d self.user_name"},{"line_number":383,"context_line":"        req.environ[\u0027SSL_CLIENT_I_DN_O\u0027] \u003d self.domain_name"},{"line_number":384,"context_line":"        self._load_mapping_rules("},{"line_number":385,"context_line":"            mapping_fixtures.MAPPING_WITH_USERNAME_AND_DOMAINNAME)"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_6e0fe92e","line":382,"updated":"2015-05-01 15:51:04.000000000","message":"where is SSL_CLIENT_S_DN_CN coming from?","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"0c7dc8a4bfd92959c25eb0e0eb32c07f01df1b20","unresolved":false,"context_lines":[{"line_number":379,"context_line":"        req \u003d make_request()"},{"line_number":380,"context_line":"        req.environ[CONF.tokenless_auth.issuer_attribute] \u003d self.client_issuer"},{"line_number":381,"context_line":"        req.environ[\u0027HTTP_X_PROJECT_NAME\u0027] \u003d self.project_id"},{"line_number":382,"context_line":"        req.environ[\u0027SSL_CLIENT_S_DN_CN\u0027] \u003d self.user_name"},{"line_number":383,"context_line":"        req.environ[\u0027SSL_CLIENT_I_DN_O\u0027] \u003d self.domain_name"},{"line_number":384,"context_line":"        self._load_mapping_rules("},{"line_number":385,"context_line":"            mapping_fixtures.MAPPING_WITH_USERNAME_AND_DOMAINNAME)"}],"source_content_type":"text/x-python","patch_set":24,"id":"3acd31a7_95e36905","line":382,"in_reply_to":"3acd31a7_6e0fe92e","updated":"2015-05-01 21:28:34.000000000","message":"when ssl is used, the web container will set this up from the client certificate","commit_id":"71e708e0222612aa3edd70214522f0d78071edd5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":205,"context_line":"        self.group \u003d {"},{"line_number":206,"context_line":"            \u0027name\u0027: self.group_name,"},{"line_number":207,"context_line":"            \u0027domain_id\u0027: self.domain_id,"},{"line_number":208,"context_line":"            \u0027project_id\u0027: self.project_id,"},{"line_number":209,"context_line":"        }"},{"line_number":210,"context_line":"        self.group \u003d self.identity_api.create_group(self.group)"},{"line_number":211,"context_line":""}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_8fb6c788","line":208,"updated":"2015-05-13 02:18:51.000000000","message":"why does this group need a project ID? Add a comment.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":273,"context_line":"            self._load_mapping_rules(mapping_ref)"},{"line_number":274,"context_line":""},{"line_number":275,"context_line":"        if not exception_expected:"},{"line_number":276,"context_line":"            middleware.AuthContextMiddleware(\u0027Tokenless_auth_test\u0027). \\"},{"line_number":277,"context_line":"                process_request(request)"},{"line_number":278,"context_line":"            context \u003d request.environ.get(authorization.AUTH_CONTEXT_ENV)"},{"line_number":279,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_2faebb2e","line":276,"updated":"2015-05-13 02:18:51.000000000","message":"use () to continue a line rather than \\","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d29808d93cb3c70b8ac52e33ca07f265459df586","unresolved":false,"context_lines":[{"line_number":423,"context_line":"        env \u003d {}"},{"line_number":424,"context_line":"        env[\u0027SSL_CLIENT_I_DN\u0027] \u003d self.client_issuer"},{"line_number":425,"context_line":"        env[\u0027HTTP_X_PROJECT_NAME\u0027] \u003d self.project_id"},{"line_number":426,"context_line":"        env[\u0027SSL_CLIENT_S_DN_CN\u0027] \u003d self.user_name"},{"line_number":427,"context_line":"        env[\u0027SSL_CLIENT_I_DN_O\u0027] \u003d self.domain_name"},{"line_number":428,"context_line":"        req \u003d make_request(environ\u003denv)"},{"line_number":429,"context_line":"        context \u003d self._create_context(request\u003dreq,"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a0c5dc1_8f6da706","line":426,"updated":"2015-05-13 02:18:51.000000000","message":"add a comment why SSL_CLIENT_S_DN_CN is being used here.","commit_id":"7ef63b95713a9ba82ca47ac1670a17bfe034efbf"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"a2cab849c5e8441c44c399393084b3484b548c58","unresolved":false,"context_lines":[{"line_number":27,"context_line":"from keystone.tests import unit as tests"},{"line_number":28,"context_line":"from keystone.tests.unit import mapping_fixtures"},{"line_number":29,"context_line":"from keystone.tests.unit import test_backend_sql"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"CONF \u003d cfg.CONF"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":""}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_5fbd59d6","line":30,"updated":"2015-07-15 19:57:47.000000000","message":"(nit) newline","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"8ada87ee5b062ac22c3cd494fd285e3982f06c4e","unresolved":false,"context_lines":[{"line_number":27,"context_line":"from keystone.tests import unit as tests"},{"line_number":28,"context_line":"from keystone.tests.unit import mapping_fixtures"},{"line_number":29,"context_line":"from keystone.tests.unit import test_backend_sql"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"CONF \u003d cfg.CONF"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":""}],"source_content_type":"text/x-python","patch_set":32,"id":"9a41bdd9_aec23551","line":30,"in_reply_to":"9a41bdd9_5fbd59d6","updated":"2015-07-16 02:50:56.000000000","message":"done","commit_id":"2a02203512d118c25c6c74c517aa54a7168fa1f6"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"e64ac0161dad0f25fd7011c9e24a4fa1a3242680","unresolved":false,"context_lines":[{"line_number":171,"context_line":"        # 2) Create a project for the user."},{"line_number":172,"context_line":"        self.project \u003d {"},{"line_number":173,"context_line":"            \u0027description\u0027: uuid.uuid4().hex,"},{"line_number":174,"context_line":"            \"domain_id\": self.domain_id,"},{"line_number":175,"context_line":"            \u0027enabled\u0027: True,"},{"line_number":176,"context_line":"            \u0027id\u0027: self.project_id,"},{"line_number":177,"context_line":"            \u0027name\u0027: self.project_name,"}],"source_content_type":"text/x-python","patch_set":40,"id":"9a41bdd9_bc9a0fc4","line":174,"updated":"2015-07-17 13:45:41.000000000","message":"(nit) single quotes should be here","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"c96b984cb110bd0df4fb322c0657686604287e88","unresolved":false,"context_lines":[{"line_number":171,"context_line":"        # 2) Create a project for the user."},{"line_number":172,"context_line":"        self.project \u003d {"},{"line_number":173,"context_line":"            \u0027description\u0027: uuid.uuid4().hex,"},{"line_number":174,"context_line":"            \"domain_id\": self.domain_id,"},{"line_number":175,"context_line":"            \u0027enabled\u0027: True,"},{"line_number":176,"context_line":"            \u0027id\u0027: self.project_id,"},{"line_number":177,"context_line":"            \u0027name\u0027: self.project_name,"}],"source_content_type":"text/x-python","patch_set":40,"id":"3a50d1a3_39cfea80","line":174,"in_reply_to":"9a41bdd9_bc9a0fc4","updated":"2015-07-20 18:56:00.000000000","message":"good catch.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"e64ac0161dad0f25fd7011c9e24a4fa1a3242680","unresolved":false,"context_lines":[{"line_number":251,"context_line":"    def _mapping_ref(self, rules\u003dNone):"},{"line_number":252,"context_line":"        return {"},{"line_number":253,"context_line":"            \u0027id\u0027: uuid.uuid4().hex,"},{"line_number":254,"context_line":"            \u0027rules\u0027: rules[\u0027rules\u0027]"},{"line_number":255,"context_line":"        }"},{"line_number":256,"context_line":""},{"line_number":257,"context_line":"    def _assert_tokenless_auth_context(self, context, ephemeral_user\u003dFalse):"}],"source_content_type":"text/x-python","patch_set":40,"id":"9a41bdd9_fcc73762","line":254,"updated":"2015-07-17 13:45:41.000000000","message":"If rules will not be passed, TypeError will be here. I understand that it\u0027s for test only, but lets not make any confusion here.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"c96b984cb110bd0df4fb322c0657686604287e88","unresolved":false,"context_lines":[{"line_number":251,"context_line":"    def _mapping_ref(self, rules\u003dNone):"},{"line_number":252,"context_line":"        return {"},{"line_number":253,"context_line":"            \u0027id\u0027: uuid.uuid4().hex,"},{"line_number":254,"context_line":"            \u0027rules\u0027: rules[\u0027rules\u0027]"},{"line_number":255,"context_line":"        }"},{"line_number":256,"context_line":""},{"line_number":257,"context_line":"    def _assert_tokenless_auth_context(self, context, ephemeral_user\u003dFalse):"}],"source_content_type":"text/x-python","patch_set":40,"id":"3a50d1a3_99b07ef6","line":254,"in_reply_to":"9a41bdd9_fcc73762","updated":"2015-07-20 18:56:00.000000000","message":"sure.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"e64ac0161dad0f25fd7011c9e24a4fa1a3242680","unresolved":false,"context_lines":[{"line_number":268,"context_line":"            self.assertEqual(self.user[\u0027id\u0027], context[\u0027user_id\u0027])"},{"line_number":269,"context_line":""},{"line_number":270,"context_line":"    def _create_context(self, request, mapping_ref\u003dNone,"},{"line_number":271,"context_line":"                        exception_expected\u003dFalse):"},{"line_number":272,"context_line":"        if mapping_ref:"},{"line_number":273,"context_line":"            self._load_mapping_rules(mapping_ref)"},{"line_number":274,"context_line":""}],"source_content_type":"text/x-python","patch_set":40,"id":"9a41bdd9_3c26ff16","line":271,"updated":"2015-07-17 13:45:41.000000000","message":"Could you please add some description of the parameters? I don\u0027t quite understand from the code what \"exception_expected\" means.\n\nEdit: after reading code below I understand what it\u0027s for. This function needs to be either documented or split into 2 functions.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"c96b984cb110bd0df4fb322c0657686604287e88","unresolved":false,"context_lines":[{"line_number":268,"context_line":"            self.assertEqual(self.user[\u0027id\u0027], context[\u0027user_id\u0027])"},{"line_number":269,"context_line":""},{"line_number":270,"context_line":"    def _create_context(self, request, mapping_ref\u003dNone,"},{"line_number":271,"context_line":"                        exception_expected\u003dFalse):"},{"line_number":272,"context_line":"        if mapping_ref:"},{"line_number":273,"context_line":"            self._load_mapping_rules(mapping_ref)"},{"line_number":274,"context_line":""}],"source_content_type":"text/x-python","patch_set":40,"id":"3a50d1a3_99871e0f","line":271,"in_reply_to":"9a41bdd9_3c26ff16","updated":"2015-07-20 18:56:00.000000000","message":"sure, will include some descriptions.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"e64ac0161dad0f25fd7011c9e24a4fa1a3242680","unresolved":false,"context_lines":[{"line_number":382,"context_line":"        env[\u0027SSL_CLIENT_DOMAIN_NAME\u0027] \u003d self.domain_name"},{"line_number":383,"context_line":"        req \u003d make_request(environ\u003denv)"},{"line_number":384,"context_line":"        context \u003d self._create_context(request\u003dreq,"},{"line_number":385,"context_line":"                                       mapping_ref\u003dmapping_fixtures."},{"line_number":386,"context_line":"                                       MAPPING_WITH_USERNAME_AND_DOMAINNAME)"},{"line_number":387,"context_line":"        self._assert_tokenless_auth_context(context)"},{"line_number":388,"context_line":""}],"source_content_type":"text/x-python","patch_set":40,"id":"9a41bdd9_87a49808","line":385,"updated":"2015-07-17 13:45:41.000000000","message":"(nit) just move it to the next line. First I thought that the dot in the end of the line is a comma and tried looking for MAPPING_WITH_USERNAME_AND_DOMAINNAME constant on top of the module. This line and other lines below.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"c96b984cb110bd0df4fb322c0657686604287e88","unresolved":false,"context_lines":[{"line_number":382,"context_line":"        env[\u0027SSL_CLIENT_DOMAIN_NAME\u0027] \u003d self.domain_name"},{"line_number":383,"context_line":"        req \u003d make_request(environ\u003denv)"},{"line_number":384,"context_line":"        context \u003d self._create_context(request\u003dreq,"},{"line_number":385,"context_line":"                                       mapping_ref\u003dmapping_fixtures."},{"line_number":386,"context_line":"                                       MAPPING_WITH_USERNAME_AND_DOMAINNAME)"},{"line_number":387,"context_line":"        self._assert_tokenless_auth_context(context)"},{"line_number":388,"context_line":""}],"source_content_type":"text/x-python","patch_set":40,"id":"3a50d1a3_d9e286d5","line":385,"in_reply_to":"9a41bdd9_87a49808","updated":"2015-07-20 18:56:00.000000000","message":"I will see what I can improve the formatting here.","commit_id":"91058af45c9cdddab31c3bc0995fbb2ab905175b"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"436d78ae83b92b85e2b4146cbbabb7ec0592352f","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"from keystone.common import authorization"},{"line_number":22,"context_line":"from keystone.common import tokenless_auth"},{"line_number":23,"context_line":"from keystone.contrib.federation import constants"},{"line_number":24,"context_line":"from keystone import exception"},{"line_number":25,"context_line":"from keystone import middleware"},{"line_number":26,"context_line":"from keystone.tests import unit as tests"}],"source_content_type":"text/x-python","patch_set":43,"id":"3a50d1a3_a15c26ee","line":23,"updated":"2015-07-24 18:07:37.000000000","message":"everywhere else we use federation_constants","commit_id":"d05acbf5007f932b41cd36e28575f238e046f332"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"8821e4475aecd947fda8b09b33d1a80c6f865357","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"from keystone.common import authorization"},{"line_number":22,"context_line":"from keystone.common import tokenless_auth"},{"line_number":23,"context_line":"from keystone.contrib.federation import constants"},{"line_number":24,"context_line":"from keystone import exception"},{"line_number":25,"context_line":"from keystone import middleware"},{"line_number":26,"context_line":"from keystone.tests import unit as tests"}],"source_content_type":"text/x-python","patch_set":43,"id":"3a50d1a3_fe688089","line":23,"in_reply_to":"3a50d1a3_a15c26ee","updated":"2015-07-24 22:21:47.000000000","message":"yep, will get that fixed.","commit_id":"d05acbf5007f932b41cd36e28575f238e046f332"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"436d78ae83b92b85e2b4146cbbabb7ec0592352f","unresolved":false,"context_lines":[{"line_number":251,"context_line":"    def _mapping_ref(self, rules\u003dNone):"},{"line_number":252,"context_line":"        return {"},{"line_number":253,"context_line":"            \u0027id\u0027: uuid.uuid4().hex,"},{"line_number":254,"context_line":"            \u0027rules\u0027: rules[\u0027rules\u0027] or {}"},{"line_number":255,"context_line":"        }"},{"line_number":256,"context_line":""},{"line_number":257,"context_line":"    def _assert_tokenless_auth_context(self, context, ephemeral_user\u003dFalse):"}],"source_content_type":"text/x-python","patch_set":43,"id":"3a50d1a3_c1b932ee","line":254,"updated":"2015-07-24 18:07:37.000000000","message":"nope, it didn\u0027t fix the issue: http://paste.openstack.org/show/405385/","commit_id":"d05acbf5007f932b41cd36e28575f238e046f332"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"8821e4475aecd947fda8b09b33d1a80c6f865357","unresolved":false,"context_lines":[{"line_number":251,"context_line":"    def _mapping_ref(self, rules\u003dNone):"},{"line_number":252,"context_line":"        return {"},{"line_number":253,"context_line":"            \u0027id\u0027: uuid.uuid4().hex,"},{"line_number":254,"context_line":"            \u0027rules\u0027: rules[\u0027rules\u0027] or {}"},{"line_number":255,"context_line":"        }"},{"line_number":256,"context_line":""},{"line_number":257,"context_line":"    def _assert_tokenless_auth_context(self, context, ephemeral_user\u003dFalse):"}],"source_content_type":"text/x-python","patch_set":43,"id":"3a50d1a3_feff20a8","line":254,"in_reply_to":"3a50d1a3_c1b932ee","updated":"2015-07-24 22:21:47.000000000","message":"yep, agree.","commit_id":"d05acbf5007f932b41cd36e28575f238e046f332"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"436d78ae83b92b85e2b4146cbbabb7ec0592352f","unresolved":false,"context_lines":[{"line_number":397,"context_line":"        req \u003d make_request(environ\u003denv)"},{"line_number":398,"context_line":"        context \u003d self._create_context("},{"line_number":399,"context_line":"            request\u003dreq,"},{"line_number":400,"context_line":"            mapping_ref\u003dmapping_fixtures.MAPPING_WITH_USERNAME_AND_DOMAINNAME)"},{"line_number":401,"context_line":"        self._assert_tokenless_auth_context(context)"},{"line_number":402,"context_line":""},{"line_number":403,"context_line":"    def test_proj_scope_with_proj_id_only_success(self):"}],"source_content_type":"text/x-python","patch_set":43,"id":"3a50d1a3_219c9668","line":400,"updated":"2015-07-24 18:07:37.000000000","message":"looks much better, thank you","commit_id":"d05acbf5007f932b41cd36e28575f238e046f332"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"8821e4475aecd947fda8b09b33d1a80c6f865357","unresolved":false,"context_lines":[{"line_number":397,"context_line":"        req \u003d make_request(environ\u003denv)"},{"line_number":398,"context_line":"        context \u003d self._create_context("},{"line_number":399,"context_line":"            request\u003dreq,"},{"line_number":400,"context_line":"            mapping_ref\u003dmapping_fixtures.MAPPING_WITH_USERNAME_AND_DOMAINNAME)"},{"line_number":401,"context_line":"        self._assert_tokenless_auth_context(context)"},{"line_number":402,"context_line":""},{"line_number":403,"context_line":"    def test_proj_scope_with_proj_id_only_success(self):"}],"source_content_type":"text/x-python","patch_set":43,"id":"3a50d1a3_1e20cc48","line":400,"in_reply_to":"3a50d1a3_219c9668","updated":"2015-07-24 22:21:47.000000000","message":":-)","commit_id":"d05acbf5007f932b41cd36e28575f238e046f332"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"960cb80720283eef0de77234e758267eb90a2d3d","unresolved":false,"context_lines":[{"line_number":128,"context_line":"        self.assertEqual({}, params)"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"class AuthContextMiddlewareTest(test_backend_sql.SqlTests):"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"    def setUp(self):"},{"line_number":134,"context_line":"        super(AuthContextMiddlewareTest, self).setUp()"}],"source_content_type":"text/x-python","patch_set":50,"id":"fa1b9901_ee606ed1","line":131,"updated":"2015-08-20 02:12:44.000000000","message":"Name the test class to be more specific to tokenless x509","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5c35fe32e246aaf52a8f5de28d61a87faea3a722","unresolved":false,"context_lines":[{"line_number":128,"context_line":"        self.assertEqual({}, params)"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"class AuthContextMiddlewareTest(test_backend_sql.SqlTests):"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"    def setUp(self):"},{"line_number":134,"context_line":"        super(AuthContextMiddlewareTest, self).setUp()"}],"source_content_type":"text/x-python","patch_set":50,"id":"fa1b9901_9a19b724","line":131,"in_reply_to":"fa1b9901_ee606ed1","updated":"2015-08-21 01:19:55.000000000","message":"I think it\u0027s better to follow the convention to use the name that can match with the class name in the implementation so that the test cases can be easier to located.","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"960cb80720283eef0de77234e758267eb90a2d3d","unresolved":false,"context_lines":[{"line_number":179,"context_line":""},{"line_number":180,"context_line":"        self.resource_api.create_project(self.project_id, self.project)"},{"line_number":181,"context_line":""},{"line_number":182,"context_line":"        # 3) Create an user in new domain."},{"line_number":183,"context_line":"        self.user \u003d {"},{"line_number":184,"context_line":"            \u0027name\u0027: self.user_name,"},{"line_number":185,"context_line":"            \u0027domain_id\u0027: self.domain_id,"}],"source_content_type":"text/x-python","patch_set":50,"id":"fa1b9901_d367554b","line":182,"updated":"2015-08-20 02:12:44.000000000","message":"an -\u003e a","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5c35fe32e246aaf52a8f5de28d61a87faea3a722","unresolved":false,"context_lines":[{"line_number":179,"context_line":""},{"line_number":180,"context_line":"        self.resource_api.create_project(self.project_id, self.project)"},{"line_number":181,"context_line":""},{"line_number":182,"context_line":"        # 3) Create an user in new domain."},{"line_number":183,"context_line":"        self.user \u003d {"},{"line_number":184,"context_line":"            \u0027name\u0027: self.user_name,"},{"line_number":185,"context_line":"            \u0027domain_id\u0027: self.domain_id,"}],"source_content_type":"text/x-python","patch_set":50,"id":"fa1b9901_9af0d7ca","line":182,"in_reply_to":"fa1b9901_d367554b","updated":"2015-08-21 01:19:55.000000000","message":"done","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"960cb80720283eef0de77234e758267eb90a2d3d","unresolved":false,"context_lines":[{"line_number":496,"context_line":"            mapping_ref\u003dmapping_fixtures.MAPPING_WITH_USERNAME_AND_DOMAINID)"},{"line_number":497,"context_line":"        self._assert_tokenless_auth_context(context)"},{"line_number":498,"context_line":""},{"line_number":499,"context_line":"    def test_only_domainname_fail(self):"},{"line_number":500,"context_line":"        env \u003d {}"},{"line_number":501,"context_line":"        env[\u0027SSL_CLIENT_I_DN\u0027] \u003d self.client_issuer"},{"line_number":502,"context_line":"        env[\u0027HTTP_X_PROJECT_ID\u0027] \u003d self.project_id"}],"source_content_type":"text/x-python","patch_set":50,"id":"fa1b9901_8e23f2a6","line":499,"updated":"2015-08-20 02:12:44.000000000","message":"use domain_name for readability","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5c35fe32e246aaf52a8f5de28d61a87faea3a722","unresolved":false,"context_lines":[{"line_number":496,"context_line":"            mapping_ref\u003dmapping_fixtures.MAPPING_WITH_USERNAME_AND_DOMAINID)"},{"line_number":497,"context_line":"        self._assert_tokenless_auth_context(context)"},{"line_number":498,"context_line":""},{"line_number":499,"context_line":"    def test_only_domainname_fail(self):"},{"line_number":500,"context_line":"        env \u003d {}"},{"line_number":501,"context_line":"        env[\u0027SSL_CLIENT_I_DN\u0027] \u003d self.client_issuer"},{"line_number":502,"context_line":"        env[\u0027HTTP_X_PROJECT_ID\u0027] \u003d self.project_id"}],"source_content_type":"text/x-python","patch_set":50,"id":"fa1b9901_7ac06350","line":499,"in_reply_to":"fa1b9901_8e23f2a6","updated":"2015-08-21 01:19:55.000000000","message":"done","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"960cb80720283eef0de77234e758267eb90a2d3d","unresolved":false,"context_lines":[{"line_number":511,"context_line":"                          context.process_request,"},{"line_number":512,"context_line":"                          req)"},{"line_number":513,"context_line":""},{"line_number":514,"context_line":"    def test_only_domainid_fail(self):"},{"line_number":515,"context_line":"        env \u003d {}"},{"line_number":516,"context_line":"        env[\u0027SSL_CLIENT_I_DN\u0027] \u003d self.client_issuer"},{"line_number":517,"context_line":"        env[\u0027HTTP_X_PROJECT_ID\u0027] \u003d self.project_id"}],"source_content_type":"text/x-python","patch_set":50,"id":"fa1b9901_6e553ef8","line":514,"updated":"2015-08-20 02:12:44.000000000","message":"use domain_id for readability","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"5c35fe32e246aaf52a8f5de28d61a87faea3a722","unresolved":false,"context_lines":[{"line_number":511,"context_line":"                          context.process_request,"},{"line_number":512,"context_line":"                          req)"},{"line_number":513,"context_line":""},{"line_number":514,"context_line":"    def test_only_domainid_fail(self):"},{"line_number":515,"context_line":"        env \u003d {}"},{"line_number":516,"context_line":"        env[\u0027SSL_CLIENT_I_DN\u0027] \u003d self.client_issuer"},{"line_number":517,"context_line":"        env[\u0027HTTP_X_PROJECT_ID\u0027] \u003d self.project_id"}],"source_content_type":"text/x-python","patch_set":50,"id":"fa1b9901_1ab3670b","line":514,"in_reply_to":"fa1b9901_6e553ef8","updated":"2015-08-21 01:19:55.000000000","message":"done","commit_id":"00451fcf3f5189b7c488d4d60cdadd7bce84fa56"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"b855d7436c76de567dae2d6451b38b78d528dffd","unresolved":false,"context_lines":[{"line_number":707,"context_line":"                                   protocol\u003d\u0027x509\u0027)"},{"line_number":708,"context_line":"        self.protocol_id \u003d \u0027x509\u0027"},{"line_number":709,"context_line":"        mapping_fixtures.MAPPING_FOR_EPHEMERAL_USER["},{"line_number":710,"context_line":"            \u0027rules\u0027][0][\u0027local\u0027][0][\u0027group\u0027][\u0027id\u0027] \u003d uuid.uuid4().hex"},{"line_number":711,"context_line":"        context \u003d self._create_context("},{"line_number":712,"context_line":"            request\u003dreq,"},{"line_number":713,"context_line":"            mapping_ref\u003dmapping_fixtures.MAPPING_FOR_EPHEMERAL_USER,"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_9281404d","line":710,"updated":"2015-08-27 12:57:53.000000000","message":"maybe copy this dictionary first? I am not sure.","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"d9e08f1ceb45ea04555b48d7b3fb86fd0991fe85","unresolved":false,"context_lines":[{"line_number":707,"context_line":"                                   protocol\u003d\u0027x509\u0027)"},{"line_number":708,"context_line":"        self.protocol_id \u003d \u0027x509\u0027"},{"line_number":709,"context_line":"        mapping_fixtures.MAPPING_FOR_EPHEMERAL_USER["},{"line_number":710,"context_line":"            \u0027rules\u0027][0][\u0027local\u0027][0][\u0027group\u0027][\u0027id\u0027] \u003d uuid.uuid4().hex"},{"line_number":711,"context_line":"        context \u003d self._create_context("},{"line_number":712,"context_line":"            request\u003dreq,"},{"line_number":713,"context_line":"            mapping_ref\u003dmapping_fixtures.MAPPING_FOR_EPHEMERAL_USER,"}],"source_content_type":"text/x-python","patch_set":55,"id":"da20952f_8f21fcfd","line":710,"in_reply_to":"da20952f_9281404d","updated":"2015-08-27 22:42:00.000000000","message":"This should not matter for the testcase as every single test case will call setup again to setup all the resources. But let me change that for better code practice ;-)","commit_id":"9de10c8dd05c212492c539efb18576b96f4ca0a6"}],"keystone/token/providers/common.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94e82e67115bd8d747a95a66e26e915fa1b0669c","unresolved":false,"context_lines":[{"line_number":359,"context_line":"            for x in (\u0027roles\u0027, \u0027user\u0027, \u0027catalog\u0027, \u0027project\u0027, \u0027domain\u0027):"},{"line_number":360,"context_line":"                if x in token:"},{"line_number":361,"context_line":"                    token_data[x] \u003d token[x]"},{"line_number":362,"context_line":""},{"line_number":363,"context_line":"        if CONF.trust.enabled and trust:"},{"line_number":364,"context_line":"            if user_id !\u003d trust[\u0027trustee_user_id\u0027]:"},{"line_number":365,"context_line":"                raise exception.Forbidden(_(\u0027User is not a trustee.\u0027))"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_ed63cf17","side":"PARENT","line":362,"updated":"2015-02-18 04:09:12.000000000","message":"undo this change","commit_id":"687e4d2c81d348bcb9a487ee272983f75cb5141d"}]}